# CVE-2026-93011: dnsmasq heap out-of-bounds write in DNSSEC validator

Source: https://junglewise.ai/threats/cve-2026-93011-a-flaw-was-found-in-dnsmasq-after-a-reduction-of-internal-domain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-93011 · Severity: medium · CVSS 5.3 · Published 2026-10-29

dnsmasq is a lightweight DNS and DHCP server used in networks and embedded systems. A flaw in its optional DNSSEC validation feature allows attackers to write a small amount of data past a buffer boundary, potentially corrupting heap metadata. This requires DNSSEC to be explicitly enabled and a crafted DNSSEC response to be validated, but could lead to unexpected server behavior or crashes if exploited.

Technologies: [Dnsmasq](https://junglewise.ai/threats/technologies/x-dnsmasq).

## Quick answers

**Is CVE-2026-93011 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93011 being exploited in the wild.

**How severe is CVE-2026-93011?** Medium severity, with a CVSS score of 5.3, published 29 October 2026.

**Which products and versions are affected?** Dnsmasq v2.93 and later.

**Is there a fix for CVE-2026-93011?** No fixed version is recorded yet. Do not enable --dnssec or --trust-anchor flags unless DNSSEC validation is required. If DNSSEC validation is necessary, restrict dnsmasq to trusted upstream resolvers only. Alternatively, omit -DHAVE_DNSSEC from the build configuration to disable DNSSEC support entirely (the default).</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93011 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-93011?** Check whether you run Dnsmasq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not enable --dnssec or --trust-anchor flags unless DNSSEC validation is required. If DNSSEC validation is necessary, restrict dnsmasq to trusted upstream resolvers only. Alternatively, omit -DHAVE_DNSSEC from the build configuration to disable DNSSEC support entirely (the default).</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}]

## Technical details

The DNSSEC validator writes 1–3 bytes past a domain-name buffer when converting DNS wire format names to internal representation, due to undersized buffers introduced in dnsmasq v2.93. An attacker who controls a DNSSEC response can trigger the overwrite on startup heap metadata that is never freed. Exploitation requires DNSSEC support to be compiled in (off by default) and enabled at runtime via --dnssec or --trust-anchor flags; no crashes have been demonstrated in testing.

## Affected products

- dnsmasq v2.93 and later

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-93011](https://access.redhat.com/security/cve/CVE-2026-93011)

## Related threats

- [dnsmasq out-of-bounds read in DHCPv6 FQDN parser](https://junglewise.ai/threats/cve-2026-93009-a-flaw-was-found-in-dnsmasq-the-dhcpv6-client-hostname-parser-can)
- [dnsmasq TCP DNS connection pool exhaustion denial of service](https://junglewise.ai/threats/cve-2026-93007-a-flaw-was-found-in-dnsmasq-the-tcp-dns-service-uses-a-small)