Is CVE-2026-93011 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93011 being exploited in the wild.

How severe is CVE-2026-93011?

Medium severity, with a CVSS score of 5.3, published 29 October 2026.

How is CVE-2026-93011 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-93011?

Check whether you run Dnsmasq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93011: dnsmasq heap out-of-bounds write in DNSSEC validator

CVE-2026-93011 · Severity: medium · CVSS 5.3 · Published 2026-10-29

dnsmasq is a lightweight DNS and DHCP server used in networks and embedded systems. A flaw in its optional DNSSEC validation feature allows attackers to write a small amount of data past a buffer boundary, potentially corrupting heap metadata. This requires DNSSEC to be explicitly enabled and a crafted DNSSEC response to be validated, but could lead to unexpected server behavior or crashes if exploited.

Technologies: Dnsmasq.

Quick answers

Is CVE-2026-93011 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93011 being exploited in the wild.
How severe is CVE-2026-93011?: Medium severity, with a CVSS score of 5.3, published 29 October 2026.
Which products and versions are affected?: Dnsmasq v2.93 and later.
Is there a fix for CVE-2026-93011?: No fixed version is recorded yet. Do not enable --dnssec or --trust-anchor flags unless DNSSEC validation is required. If DNSSEC validation is necessary, restrict dnsmasq to trusted upstream resolvers only. Alternatively, omit -DHAVE_DNSSEC from the build configuration to disable DNSSEC support entirely (the default).</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93011 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-93011?: Check whether you run Dnsmasq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Do not enable --dnssec or --trust-anchor flags unless DNSSEC validation is required. If DNSSEC validation is necessary, restrict dnsmasq to trusted upstream resolvers only. Alternatively, omit -DHAVE_DNSSEC from the build configuration to disable DNSSEC support entirely (the default).</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}]

Technical details

The DNSSEC validator writes 1–3 bytes past a domain-name buffer when converting DNS wire format names to internal representation, due to undersized buffers introduced in dnsmasq v2.93. An attacker who controls a DNSSEC response can trigger the overwrite on startup heap metadata that is never freed. Exploitation requires DNSSEC support to be compiled in (off by default) and enabled at runtime via --dnssec or --trust-anchor flags; no crashes have been demonstrated in testing.

Affected products

dnsmasq v2.93 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.