{"id":"CVE-2026-93009","kind":"vulnerability","aliases":["CVE-2026-93009"],"related":[],"title":"dnsmasq: DHCPv6 hostname parser reads one byte past buffer","description":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.","summary":"dnsmasq's DHCPv6 client hostname parser can read one byte beyond the end of a crafted FQDN option because it checks a label length before confirming the pointer is still inside the option. An attacker on the local network can trigger the out-of-bounds read with a single DHCPv6 packet, but the extra byte is not returned or logged and no crash has been demonstrated.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcpv6","dnsmasq","linux","package","routers","self-hosted"],"not_affected_if":["managed-hosting","no-dhcpv6"],"how_to_check":"- Run `dnsmasq --version` to see the installed version.\n- Check whether DHCPv6 is enabled in the dnsmasq configuration (a `dhcp-range` line with IPv6 addresses).","fix":null,"status":"open","published_at":"2026-10-29T14:18:00+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:18+00:00","updated_at":"2026-10-29T14:26:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T14:26:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"dnsmasq: DHCPv6 hostname parser reads one byte past buffer","impact":"low","summary":"dnsmasq's DHCPv6 client hostname parser can read one byte beyond the end of a crafted FQDN option because it checks a label length before confirming the pointer is still inside the option. An attacker on the local network can trigger the out-of-bounds read with a single DHCPv6 packet, but the extra byte is not returned or logged and no crash has been demonstrated.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dnsmasq","dhcpv6","linux","routers","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"out-of-bounds read of one byte; no code execution shown","analyst_note":"Check the NVD entry and dnsmasq upstream for affected version range and fixed release; confirm whether DHCPv6 must be enabled to be exposed.","how_to_check":"- Run `dnsmasq --version` to see the installed version.\n- Check whether DHCPv6 is enabled in the dnsmasq configuration (a `dhcp-range` line with IPv6 addresses).\n- Unknown whether the sources list affected version ranges.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dhcpv6","managed-hosting"],"who_is_affected":"Only hosts running dnsmasq as a DHCPv6 server on a network reachable by the attacker are exposed, since the flaw is in parsing client DHCPv6 packets. Systems that do not run dnsmasq DHCPv6, or that run it without IPv6 DHCP, can skip it. The sources do not give affected version ranges.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000736,"input_tokens":4124,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-93009':12A,15A 'attack':58B,131C 'beyond':34B 'bound':69B 'buffer':9A 'byte':7A,33B,79B,105C,146C 'check':44B,116C 'client':27B,99C,152C 'confirm':49B,122C 'craft':39B,111C 'crash':87B,157C 'cve':10A,13A 'demonstr':90B,160C 'dhcpv6':2A,16B,26B,74B,98C,142C 'dnsmasq':1A,17B,24B,96C 'end':36B,108C 'extra':78B,145C 'flaw':92C 'found':94C 'fqdn':40B,112C 'host':23B 'hostnam':3A,28B,100C 'insid':54B,127C 'label':46B,119C 'length':47B,120C 'linux':18B 'local':61B,134C 'log':84B,154C 'network':62B,135C 'next':118C 'one':6A,32B,104C 'option':41B,56B,113C,129C 'out-of-bound':66B 'packag':19B 'packet':75B,143C 'parser':4A,29B,101C 'past':8A,106C 'pointer':51B,124C 'read':5A,31B,70B,103C 'return':82B,149C 'router':20B 'self':22B 'self-host':21B 'singl':73B,141C 'still':53B,126C 'trigger':64B,137C","nicknames":[],"mitigations":[],"who_affected":"Only hosts running dnsmasq as a DHCPv6 server on a network reachable by the attacker are exposed, since the flaw is in parsing client DHCPv6 packets. Systems that do not run dnsmasq DHCPv6, or that run it without IPv6 DHCP, can skip it. The sources do not give affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93009","severity":null,"published_at":"2026-10-29T14:18:00+00:00","modified_at":"2026-10-29T14:18:00+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}