# CVE-2026-93007: dnsmasq TCP DNS connection pool exhaustion denial of service

Source: https://junglewise.ai/threats/cve-2026-93007-a-flaw-was-found-in-dnsmasq-the-tcp-dns-service-uses-a-small  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-93007 · Severity: medium · CVSS 5.3 · Published 2026-10-29

dnsmasq is a DNS and DHCP server commonly used on networks to resolve domain names. A remote attacker can exhaust the small pool of TCP child processes by opening idle connections to port 53, preventing legitimate DNS over TCP requests and DNSSEC validation from working, though basic UDP DNS continues to function. The disruption auto-recovers after 150 seconds if the attacker stops, limiting the immediate impact but allowing repeated attacks.

Technologies: [Dnsmasq](https://junglewise.ai/threats/technologies/x-dnsmasq).

## Quick answers

**Is CVE-2026-93007 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93007 being exploited in the wild.

**How severe is CVE-2026-93007?** Medium severity, with a CVSS score of 5.3, published 29 October 2026.

**Which products and versions are affected?** dnsmasq.

**Is there a fix for CVE-2026-93007?** No fixed version is recorded yet. Increase the TCP connection limit using the --max-tcp-connections parameter to raise the threshold an attacker must overcome. Additionally, implement firewall rules to limit per-source TCP connections to port 53 (using iptables connlimit on tcp/53) and restrict access to port 53 from untrusted networks if TCP DNS is not required from those sources.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93007 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-93007?** Check whether you run Dnsmasq. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Increase the TCP connection limit using the --max-tcp-connections parameter to raise the threshold an attacker must overcome. Additionally, implement firewall rules to limit per-source TCP connections to port 53 (using iptables connlimit on tcp/53) and restrict access to port 53 from untrusted networks if TCP DNS is not required from those sources.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}]

## Technical details

The vulnerability is a resource exhaustion flaw (CWE-400) in dnsmasq's TCP DNS service. The server maintains a fixed pool of child processes for TCP connections and does not enforce receive timeouts on idle clients. A remote attacker on the network can open many idle TCP connections to port 53, occupying all available slots and blocking legitimate TCP DNS queries and DNSSEC validation fallback. UDP resolution remains functional, and connections time out after a fixed period (~150 seconds).

## Affected products

- dnsmasq

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-93007](https://access.redhat.com/security/cve/CVE-2026-93007)

## Related threats

- [dnsmasq out-of-bounds read in DHCPv6 FQDN parser](https://junglewise.ai/threats/cve-2026-93009-a-flaw-was-found-in-dnsmasq-the-dhcpv6-client-hostname-parser-can)
- [dnsmasq heap out-of-bounds write in DNSSEC validator](https://junglewise.ai/threats/cve-2026-93011-a-flaw-was-found-in-dnsmasq-after-a-reduction-of-internal-domain)