---
id: "CVE-2026-93007"
kind: "vulnerability"
aliases: ["CVE-2026-93007"]
title: "dnsmasq: idle TCP connections can exhaust DNS service child process pool"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dns", "dnsmasq", "infrastructure", "self-hosted"]
not_affected_if: ["tcp-53-firewalled", "udp-only-dns"]
published_at: "2026-10-29T13:17:15+00:00"
first_seen_at: "2026-10-29T13:25:08+00:00"
updated_at: "2026-10-29T13:25:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93007", "first_seen_at": "2026-10-29T13:25:08+00:00"}]
---

# dnsmasq: idle TCP connections can exhaust DNS service child process pool

dnsmasq's TCP DNS service uses a small fixed pool of child processes and sets no receive timeout on client connections. A remote attacker can hold idle connections to port 53 to occupy the whole pool, blocking new TCP DNS queries and DNSSEC validation that falls back to TCP.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `dnsmasq --version` and compare it against the fixed release in the vendor advisory (unknown from these sources)
- Confirm whether the service listens on TCP port 53 from outside the network, e.g. `ss -ltnp | grep :53`

## Timeline

- 2026-10-29T13:25:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93007

## From the sources

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_