Live › vulnerability › CVE-2026-93009
dnsmasq's DHCPv6 client hostname parser can read one byte beyond the end of a crafted FQDN option because it checks a label length before confirming the pointer is still inside the option. An attacker on the local network can trigger the out-of-bounds read with a single DHCPv6 packet, but the extra byte is not returned or logged and no crash has been demonstrated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Only hosts running dnsmasq as a DHCPv6 server on a network reachable by the attacker are exposed, since the flaw is in parsing client DHCPv6 packets. Systems that do not run dnsmasq DHCPv6, or that run it without IPv6 DHCP, can skip it. The sources do not give affected version ranges.
No product ranges from the sources yet.
dnsmasq --version to see the installed version.dhcp-range line with IPv6 addresses).No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
This page as .md · .json · in your agent: get_signal("CVE-2026-93009")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.