CVE-2026-5172: dnsmasq heap out-of-bounds read in extract_addresses

CVE-2026-5172 · Severity: high · CVSS 7.3 · Published 2026-05-11

A vulnerability in dnsmasq, a widely used tool for providing network services like DNS and DHCP, could allow an attacker to crash the service. By sending a specially crafted DNS response, an attacker can trigger a memory error that causes the software to stop functioning. This results in a denial-of-service condition, preventing users and devices on the network from resolving domain names or accessing the internet.

Technologies: Pi-hole FTL, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AppStream, Simon Kelley Dnsmasq. Vendors: Pi-hole, Red Hat, Simon Kelley.

Quick answers

Is CVE-2026-5172 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-5172 being exploited in the wild.
How severe is CVE-2026-5172?
High severity, with a CVSS score of 7.3, published 11 May 2026.
Which products and versions are affected?
Pi-hole FTL < v6.6.2, prior to 6.6.2; Red Hat Enterprise Linux AppStream 10.2; Simon Kelley Dnsmasq versions prior to 2.92rel2.
Is there a fix for CVE-2026-5172?
A patch was published on 2026-05-11: dnsmasq 2.92rel2 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5172 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-5172?
Check whether you run Pi-hole FTL, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap out-of-bounds (OOB) read vulnerability exists in dnsmasq within the extract_addresses() function. The flaw is caused by a mismatched Resource Record (RR) data length (rdlen), which allows the extract_name() function to advance the internal pointer beyond the computed end of the record. This results in an underflow of the remaining-bytes calculation, leading to a large OOB read and a subsequent process crash. The attack can be triggered by a remote attacker providing a malformed DNS response. The issue is addressed in dnsmasq version 2.92rel2 and Pi-hole FTL v6.6.2.

Affected products

  • dnsmasq dnsmasq < 2.92rel2
  • Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.2
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Pi-hole FTL < v6.6.2

Timeline

  • 2026-05-11: disclosed: Coordinated disclosure by CERT/CC and Simon Kelley
  • 2026-05-11: patched: dnsmasq 2.92rel2 released with fixes
  • 2026-05-11: advisory: NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.