Junglewise Threat Intelligence

CVE-2026-4890: dnsmasq infinite loop in DNSSEC NSEC parsing

CVE-2026-4890 · Severity: high · CVSS 7.5 · Published 2026-05-11

Executive brief

dnsmasq is a widely used software component that provides network services like DNS and DHCP to local networks and embedded devices. A vulnerability in its DNS security validation (DNSSEC) allows a remote attacker to send a specially crafted network packet that causes the software to enter an infinite loop. This results in a denial of service, preventing the device from resolving domain names and effectively cutting off internet or network access for connected users.

Technical details

A Denial of Service vulnerability exists in the DNSSEC validation logic of dnsmasq due to an infinite loop during NSEC bitmap parsing (CWE-835). The root cause is a window-iteration step that omits a 2-byte window header; when a crafted NSEC record with a bitmap_length of zero is processed, the software fails to exit the loop. This vulnerability is reachable before RRSIG validation, meaning an attacker does not need to provide valid cryptographic signatures to trigger the flaw. A remote, unauthenticated attacker can exploit this by sending a single crafted DNS packet, causing dnsmasq to stop responding to all queries. The issue is resolved in dnsmasq version 2.92rel2 and Pi-hole FTL v6.6.2.

Affected products

  • dnsmasq dnsmasq < 2.92rel2
  • Red Hat Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Red Hat Enterprise Linux AppStream (v. 10)
  • Pi-hole Pi-hole FTL < 6.6.2

Timeline

  • 2026-05-11: disclosed: Coordinated disclosure of six CVEs by CERT/CC and Simon Kelley
  • 2026-05-11: patched: dnsmasq 2.92rel2 released with fixes
  • 2026-05-11: advisory: NVD publication date

References

Related threats