Live › vulnerability › CVE-2026-93011
dnsmasq's DNSSEC validator can write a few bytes past a name buffer when converting domain names to and from DNS wire format. An attacker who gets the server to validate a crafted DNSSEC response may corrupt small amounts of adjacent heap metadata.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Only servers running dnsmasq with DNSSEC validation turned on can be exposed, since DNSSEC support is not compiled in by default and must also be enabled at runtime. An attacker must be able to make the server validate a crafted DNSSEC response, so resolvers that accept queries from untrusted clients are the ones to look at first. Systems running dnsmasq without DNSSEC enabled can skip this.
No product ranges from the sources yet.
dnsmasq --version against the affected range; the sources do not give the range.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
This page as .md · .json · in your agent: get_signal("CVE-2026-93011")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.