Is CVE-2026-4893 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4893 being exploited in the wild.

How severe is CVE-2026-4893?

Informational severity, with a CVSS score of 5.3, published 11 May 2026.

Which products and versions are affected?

Simon Kelley Dnsmasq versions prior to 2.92rel2.

Is there a fix for CVE-2026-4893?

A patch was published on 2026-05-11: Fixed in version 2.92rel2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4893 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4893?

Check whether you run Simon Kelley Dnsmasq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4893: dnsmasq information disclosure via RFC 7871 client subnet bypass

CVE-2026-4893 · Severity: info · CVSS 5.3 · Published 2026-05-11

dnsmasq is a widely used networking tool that provides DNS and DHCP services for home routers and small corporate networks. A security flaw has been identified that allows remote attackers to bypass certain source-address checks by sending specially crafted DNS packets. This could lead to the unauthorized disclosure of internal network information or allow attackers to manipulate how DNS responses are routed, potentially facilitating further attacks.

Technologies: Simon Kelley Dnsmasq. Vendors: Simon Kelley.

Quick answers

Is CVE-2026-4893 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4893 being exploited in the wild.
How severe is CVE-2026-4893?: Informational severity, with a CVSS score of 5.3, published 11 May 2026.
Which products and versions are affected?: Simon Kelley Dnsmasq versions prior to 2.92rel2.
Is there a fix for CVE-2026-4893?: A patch was published on 2026-05-11: Fixed in version 2.92rel2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4893 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4893?: Check whether you run Simon Kelley Dnsmasq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in dnsmasq due to improper handling of EDNS0 Client Subnet (ECS) options as defined in RFC 7871. By crafting a DNS packet containing specific client-subnet information, a remote, unauthenticated attacker can bypass source-address validation checks. This flaw can be exploited to leak internal network information or manipulate response routing, which may assist in DNS cache poisoning or redirection attacks. The vulnerability is addressed in dnsmasq version 2.92rel2.

Affected products

Simon Kelley dnsmasq versions prior to 2.92rel2

Timeline

2026-05-11: disclosed
2026-05-11: advisory
2026-05-11: patched: Fixed in version 2.92rel2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.