# CVE-2026-2291: dnsmasq heap buffer overflow in extract_name

Source: https://junglewise.ai/threats/cve-2026-2291-dnsmasq-heap-buffer-overflow-in-extract-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-2291 · Severity: high · CVSS 7.3 · Published 2026-05-11

dnsmasq is a widely used tool for providing network services like DNS and DHCP to small networks and home routers. A vulnerability in how it handles domain names allows an attacker to corrupt the system's memory, which can be used to redirect users to malicious websites or crash the service entirely. This could lead to users unknowingly visiting fraudulent sites or a total loss of internet connectivity for the affected network.

Technologies: [Pi-hole FTL](https://junglewise.ai/threats/technologies/ftl), [Simon Kelley Dnsmasq](https://junglewise.ai/threats/technologies/dnsmasq). Vendors: [Pi-hole](https://junglewise.ai/threats/vendors/pi-hole), [Simon Kelley](https://junglewise.ai/threats/vendors/simon-kelley).

## Quick answers

**Is CVE-2026-2291 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2291 being exploited in the wild.

**How severe is CVE-2026-2291?** High severity, with a CVSS score of 7.3, published 11 May 2026.

**Which products and versions are affected?** Pi-hole FTL prior to 6.6.2; Simon Kelley Dnsmasq versions prior to 2.92rel2.

**Is there a fix for CVE-2026-2291?** A patch was published on 2026-05-11: Fixed in version 2.92rel2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2291 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2291?** Check whether you run Pi-hole FTL or Simon Kelley Dnsmasq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in dnsmasq's extract_name() function within the bigname structure. The vulnerability stems from the on-heap namebuffer being sized for the wire form of a domain name (MAXDNAME) rather than its larger escaped internal form (MAXDNAME*2 + 1). A remote attacker sending or answering DNS queries can trigger a large out-of-bounds write on the heap. This can be exploited to poison the DNS cache, redirecting traffic to attacker-controlled IP addresses, or to cause a service crash (DoS). The issue is fixed in version 2.92rel2 and later.

## Affected products

- dnsmasq dnsmasq < 2.92rel2

## Timeline

- 2026-05-11: disclosed
- 2026-05-11: patched: Fixed in version 2.92rel2
- 2026-05-11: advisory

## References

- [https://github.com/NixOS/nixpkgs/pull/519082](https://github.com/NixOS/nixpkgs/pull/519082)
- [https://github.com/NixOS/nixpkgs/pull/519093](https://github.com/NixOS/nixpkgs/pull/519093)
- [https://github.com/pi-hole/FTL/releases/tag/v6.6.2](https://github.com/pi-hole/FTL/releases/tag/v6.6.2)
- [https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html](https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html)
- [https://thekelleys.org.uk/dnsmasq/CVE/](https://thekelleys.org.uk/dnsmasq/CVE/)
- [https://www.kb.cert.org/vuls/id/471747](https://www.kb.cert.org/vuls/id/471747)
- [https://www.suse.com/security/cve/CVE-2026-2291.html](https://www.suse.com/security/cve/CVE-2026-2291.html)

## Related threats

- [Pi-hole FTL session hijacking via race condition in HTTP engine](https://junglewise.ai/threats/cve-2026-44693-pi-hole-ftl-session-hijacking-via-race-condition-in-http-engine)
- [Pi-hole local privilege escalation via unvalidated config paths](https://junglewise.ai/threats/cve-2026-41489-pi-hole-local-privilege-escalation-via-unvalidated-config-paths)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)
- [dnsmasq information disclosure via RFC 7871 client subnet bypass](https://junglewise.ai/threats/cve-2026-4893-dnsmasq-information-disclosure-via-rfc-7871-client-subnet-bypass)
- [dnsmasq heap overflow in DHCPv6 helper](https://junglewise.ai/threats/cve-2026-4892-dnsmasq-heap-overflow-in-dhcpv6-helper)