{"id":"CVE-2026-93011","kind":"vulnerability","aliases":["CVE-2026-93011"],"related":[],"title":"dnsmasq: DNSSEC validator can overwrite adjacent heap memory","description":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.","summary":"dnsmasq's DNSSEC validator can write a few bytes past a name buffer when converting domain names to and from DNS wire format. An attacker who gets the server to validate a crafted DNSSEC response may corrupt small amounts of adjacent heap metadata.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnsmasq","infrastructure","linux","self-hosted"],"not_affected_if":["default-config","dnssec-disabled"],"how_to_check":"- Check whether DNSSEC support is compiled in and enabled at runtime; the sources say it is off by default and needs both.\n- Check the installed dnsmasq version with `dnsmasq --version` against the affected range; the sources do not give the range.","fix":null,"status":"open","published_at":"2026-10-29T13:17:16+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","triaged_at":"2026-10-29T13:25:47+00:00","updated_at":"2026-10-29T13:25:47+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T13:25:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"dnsmasq: DNSSEC validator can overwrite adjacent heap memory","impact":"medium","summary":"dnsmasq's DNSSEC validator can write a few bytes past a name buffer when converting domain names to and from DNS wire format. An attacker who gets the server to validate a crafted DNSSEC response may corrupt small amounts of adjacent heap metadata.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dnsmasq","dns-resolver","self-hosted","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"small heap corruption could lead to memory-safety compromise on the resolver","analyst_note":"Confirm affected and fixed dnsmasq versions from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-93011) or the upstream dnsmasq release notes.","how_to_check":"- Check whether DNSSEC support is compiled in and enabled at runtime; the sources say it is off by default and needs both.\n- Check the installed dnsmasq version with `dnsmasq --version` against the affected range; the sources do not give the range.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","dnssec-disabled"],"who_is_affected":"Only servers running dnsmasq with DNSSEC validation turned on can be exposed, since DNSSEC support is not compiled in by default and must also be enabled at runtime. An attacker must be able to make the server validate a crafted DNSSEC response, so resolvers that accept queries from untrusted clients are the ones to look at first. Systems running dnsmasq without DNSSEC enabled can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000737,"input_tokens":4141,"output_tokens":646,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-93011':11A,14A 'adjac':6A,64B,123C 'also':136C 'amount':62B,121C 'attack':48B,105C 'buffer':36B,81C,94C 'byte':32B,90C 'caus':108C 'compil':130C 'convert':38B,96C 'corrupt':60B 'craft':56B,114C 'cve':9A,12A 'default':133C 'dns':16B,44B,101C 'dns-resolv':15B 'dnsmasq':1A,18B,24B,72C 'dnssec':2A,26B,57B,84C,115C,126C 'domain':39B,79C 'domain-nam':78C 'enabl':138C 'flaw':68C 'format':46B,103C 'found':70C 'get':50B 'heap':7A,65B,124C 'host':23B 'infrastructur':19B 'intern':77C 'linux':20B 'may':59B,117C 'memori':8A 'metadata':66B,125C 'must':135C 'name':35B,40B,80C,93C,97C 'overwrit':5A,118C 'past':33B,91C 'reduct':75C 'resolv':17B 'respons':58B,116C 'runtim':140C 'self':22B 'self-host':21B 'server':52B,110C 'size':82C 'small':61B,120C 'support':127C 'valid':3A,27B,54B,85C,112C 'wire':45B,102C 'write':29B,87C","nicknames":[],"mitigations":[],"who_affected":"Only servers running dnsmasq with DNSSEC validation turned on can be exposed, since DNSSEC support is not compiled in by default and must also be enabled at runtime. An attacker must be able to make the server validate a crafted DNSSEC response, so resolvers that accept queries from untrusted clients are the ones to look at first. Systems running dnsmasq without DNSSEC enabled can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93011","severity":null,"published_at":"2026-10-29T13:17:16+00:00","modified_at":"2026-10-29T13:17:16+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","fetched_at":"2026-10-29T13:25:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}