# CVE-2026-4891: dnsmasq heap out-of-bounds read in DNSSEC validation

Source: https://junglewise.ai/threats/cve-2026-4891-dnsmasq-heap-out-of-bounds-read-in-dnssec-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-4891 · Severity: medium · CVSS 5.3 · Published 2026-05-11

dnsmasq is a widely used tool for providing network services like DNS and DHCP to local networks and devices. A security flaw in its DNSSEC validation component allows a remote attacker to crash the service by sending a specially crafted network packet. This results in a denial of service, preventing users and devices on the network from resolving domain names and potentially disrupting internet connectivity.

Technologies: [Pi-hole FTL](https://junglewise.ai/threats/technologies/ftl), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Pi-hole](https://junglewise.ai/threats/vendors/pi-hole), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-4891 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4891 being exploited in the wild.

**How severe is CVE-2026-4891?** Medium severity, with a CVSS score of 5.3, published 11 May 2026.

**Which products and versions are affected?** Pi-hole FTL < 6.6.2.

**Is there a fix for CVE-2026-4891?** A patch was published on 2026-05-11: dnsmasq 2.92rel2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4891 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4891?** Check whether you run Pi-hole FTL or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based out-of-bounds read vulnerability exists in the DNSSEC validation logic of dnsmasq. The flaw is triggered when processing a crafted RRSIG record where the declared resource data length (rdlen) is smaller than the combined size of the fixed RRSIG header and the signer's name. This discrepancy results in a negative signature length calculation, leading to an out-of-bounds read and a subsequent process crash. The vulnerability is reachable remotely without authentication. A fix is available in dnsmasq version 2.92rel2 and has been integrated into downstream projects like Pi-hole FTL v6.6.2.

## Affected products

- dnsmasq dnsmasq < 2.92rel2
- Red Hat Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Red Hat Enterprise Linux AppStream (v. 10)
- Red Hat Red Hat OpenShift Container Platform 4
- Pi-hole FTL < 6.6.2

## Timeline

- 2026-05-11: disclosed
- 2026-05-11: patched: dnsmasq 2.92rel2 released
- 2026-05-11: advisory: NVD published CVE-2026-4891

## References

- [https://github.com/NixOS/nixpkgs/pull/519082](https://github.com/NixOS/nixpkgs/pull/519082)
- [https://github.com/NixOS/nixpkgs/pull/519093](https://github.com/NixOS/nixpkgs/pull/519093)
- [https://github.com/pi-hole/FTL/releases/tag/v6.6.2](https://github.com/pi-hole/FTL/releases/tag/v6.6.2)
- [https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html](https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html)
- [https://thekelleys.org.uk/dnsmasq/CVE/](https://thekelleys.org.uk/dnsmasq/CVE/)
- [https://www.kb.cert.org/vuls/id/471747](https://www.kb.cert.org/vuls/id/471747)
- [https://access.redhat.com/errata/RHSA-2026:19158](https://access.redhat.com/errata/RHSA-2026:19158)

## Related threats

- [Pi-hole FTL session hijacking via race condition in HTTP engine](https://junglewise.ai/threats/cve-2026-44693-pi-hole-ftl-session-hijacking-via-race-condition-in-http-engine)
- [CESNET libyang heap buffer overflow in lyb_read_string](https://junglewise.ai/threats/cve-2026-44673-cesnet-libyang-heap-buffer-overflow-in-lyb-read-string)
- [Pi-hole local privilege escalation via unvalidated config paths](https://junglewise.ai/threats/cve-2026-41489-pi-hole-local-privilege-escalation-via-unvalidated-config-paths)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)
- [dnsmasq heap overflow in DHCPv6 helper](https://junglewise.ai/threats/cve-2026-4892-dnsmasq-heap-overflow-in-dhcpv6-helper)