Live › vulnerability › CVE-2026-93007
dnsmasq's TCP DNS service uses a small fixed pool of child processes and sets no receive timeout on client connections. A remote attacker can hold idle connections to port 53 to occupy the whole pool, blocking new TCP DNS queries and DNSSEC validation that falls back to TCP.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Any host running dnsmasq as a DNS resolver or forwarder that accepts TCP DNS on port 53 from networks an attacker can reach is exposed. Systems that only answer UDP DNS, or where port 53 TCP is restricted to trusted clients, are less exposed. unknown whether a default configuration is affected.
No product ranges from the sources yet.
dnsmasq --version and compare it against the fixed release in the vendor advisory (unknown from these sources)ss -ltnp | grep :53No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
This page as .md · .json · in your agent: get_signal("CVE-2026-93007")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.