{"id":"CVE-2026-93007","kind":"vulnerability","aliases":["CVE-2026-93007"],"related":[],"title":"dnsmasq: idle TCP connections can exhaust DNS service child process pool","description":"A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.","summary":"dnsmasq's TCP DNS service uses a small fixed pool of child processes and sets no receive timeout on client connections. A remote attacker can hold idle connections to port 53 to occupy the whole pool, blocking new TCP DNS queries and DNSSEC validation that falls back to TCP.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","dnsmasq","infrastructure","self-hosted"],"not_affected_if":["tcp-53-firewalled","udp-only-dns"],"how_to_check":"- Check the installed version with `dnsmasq --version` and compare it against the fixed release in the vendor advisory (unknown from these sources)\n- Confirm whether the service listens on TCP port 53 from outside the network, e.g. `ss -ltnp | grep :53`","fix":null,"status":"open","published_at":"2026-10-29T13:17:15+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","triaged_at":"2026-10-29T13:25:47+00:00","updated_at":"2026-10-29T13:25:47+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T13:25:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"dnsmasq: idle TCP connections can exhaust DNS service child process pool","impact":"medium","summary":"dnsmasq's TCP DNS service uses a small fixed pool of child processes and sets no receive timeout on client connections. A remote attacker can hold idle connections to port 53 to occupy the whole pool, blocking new TCP DNS queries and DNSSEC validation that falls back to TCP.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dnsmasq","self-hosted","dns"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker blocks TCP DNS resolution and DNSSEC validation","analyst_note":"Confirm affected and fixed dnsmasq versions and any workaround from the NVD entry or the upstream dnsmasq release notes.","how_to_check":"- Check the installed version with `dnsmasq --version` and compare it against the fixed release in the vendor advisory (unknown from these sources)\n- Confirm whether the service listens on TCP port 53 from outside the network, e.g. `ss -ltnp | grep :53`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["udp-only-dns","tcp-53-firewalled"],"who_is_affected":"Any host running dnsmasq as a DNS resolver or forwarder that accepts TCP DNS on port 53 from networks an attacker can reach is exposed. Systems that only answer UDP DNS, or where port 53 TCP is restricted to trusted clients, are less exposed. unknown whether a default configuration is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000727,"input_tokens":4142,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-93007':14A,17A '53':54B,111C 'attack':47B,103C 'back':70B 'block':60B 'child':9A,35B,89C 'client':43B,99C 'connect':4A,44B,51B,100C,108C,121C 'continu':132C 'cve':12A,15A 'dns':7A,18B,27B,63B,81C,120C,130C 'dnsmasq':1A,19B,24B,78C 'dnssec':66B,123C 'entir':115C 'exhaust':6A 'fall':69B 'fallback':128C 'fix':32B,86C,140C 'flaw':74C 'found':76C 'hold':49B 'host':23B 'idl':2A,50B,106C 'infrastructur':20B 'lifetim':141C 'new':61B,118C 'occupi':56B,113C,134C 'open':105C 'pool':11A,33B,59B,87C,116C 'port':53B,110C 'prevent':117C 'process':10A,36B,90C 'queri':64B 'receiv':40B,96C 'releas':137C 'remot':46B,102C 'requir':126C 'resolut':131C 'self':22B 'self-host':21B 'servic':8A,28B,82C 'set':38B,94C 'slot':135C 'small':31B,85C 'tcp':3A,26B,62B,72B,80C,107C,119C,127C 'timeout':41B,97C 'udp':129C 'use':29B,83C 'valid':67B,124C 'whole':58B","nicknames":[],"mitigations":[],"who_affected":"Any host running dnsmasq as a DNS resolver or forwarder that accepts TCP DNS on port 53 from networks an attacker can reach is exposed. Systems that only answer UDP DNS, or where port 53 TCP is restricted to trusted clients, are less exposed. unknown whether a default configuration is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93007","severity":null,"published_at":"2026-10-29T13:17:15+00:00","modified_at":"2026-10-29T13:17:16+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","fetched_at":"2026-10-29T13:25:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}