Is CVE-2026-4891 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4891 being exploited in the wild.

How severe is CVE-2026-4891?

Medium severity, with a CVSS score of 5.3, published 11 May 2026.

Is there a fix for CVE-2026-4891?

A patch was published on 2026-05-11: dnsmasq 2.92rel2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4891 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4891?

Check whether you run Pi-hole FTL or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4891: dnsmasq heap out-of-bounds read in DNSSEC validation

CVE-2026-4891 · Severity: medium · CVSS 5.3 · Published 2026-05-11

dnsmasq is a widely used tool for providing network services like DNS and DHCP to local networks and devices. A security flaw in its DNSSEC validation component allows a remote attacker to crash the service by sending a specially crafted network packet. This results in a denial of service, preventing users and devices on the network from resolving domain names and potentially disrupting internet connectivity.

Technologies: Pi-hole FTL, Red Hat Enterprise Linux AppStream. Vendors: Pi-hole, Red Hat.

Quick answers

Is CVE-2026-4891 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4891 being exploited in the wild.
How severe is CVE-2026-4891?: Medium severity, with a CVSS score of 5.3, published 11 May 2026.
Which products and versions are affected?: Pi-hole FTL < 6.6.2.
Is there a fix for CVE-2026-4891?: A patch was published on 2026-05-11: dnsmasq 2.92rel2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4891 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4891?: Check whether you run Pi-hole FTL or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based out-of-bounds read vulnerability exists in the DNSSEC validation logic of dnsmasq. The flaw is triggered when processing a crafted RRSIG record where the declared resource data length (rdlen) is smaller than the combined size of the fixed RRSIG header and the signer's name. This discrepancy results in a negative signature length calculation, leading to an out-of-bounds read and a subsequent process crash. The vulnerability is reachable remotely without authentication. A fix is available in dnsmasq version 2.92rel2 and has been integrated into downstream projects like Pi-hole FTL v6.6.2.

Affected products

dnsmasq dnsmasq < 2.92rel2
Red Hat Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Red Hat Enterprise Linux AppStream (v. 9)
Red Hat Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Red Hat OpenShift Container Platform 4
Pi-hole FTL < 6.6.2

Timeline

2026-05-11: disclosed
2026-05-11: patched: dnsmasq 2.92rel2 released
2026-05-11: advisory: NVD published CVE-2026-4891

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.