Heap Buffer Overflow Vulnerability in dnsmasq
Summary
OSV-2026-98: Heap-buffer-overflow in hostname_issubdomain. Affects dnsmasq versions >= 1269f074f86bb959863012063060a3a082d37dc4, < 1eab169173fc4c8579a3db61186096fe117e6aca. Fixed in 1eab169173fc4c8579a3db61186096fe117e6aca. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dnsmasq is a lightweight DNS forwarder and DHCP server designed to provide network infrastructure for small networks. It is widely used for its simplicity and efficiency in managing DNS and DHCP services. However, like any software, it can be susceptible to vulnerabilities that may compromise its functionality and security. The specific vulnerability in question relates to a heap buffer overflow, which can lead to potential exploitation if left unaddressed.
Vulnerability Detail
The vulnerability identified is a heap buffer overflow occurring in the function hostname_issubdomain within the dnsmasq package. This issue was reported through OSS-Fuzz, indicating that it can lead to a crash or potentially allow an attacker to execute arbitrary code. The vulnerability arises from improper handling of memory, which can be exploited when certain conditions are met, leading to unauthorized access or denial of service.
How To Fix
Minimum fixed version
1eab169173fc4c8579a3db61186096fe117e6aca
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the exposure of the dnsmasq service by restricting access to trusted networks only. Additionally, consider disabling any unnecessary features that may increase the attack surface until the patch is applied.
Conclusion
In summary, the heap buffer overflow vulnerability in dnsmasq poses a significant risk that can lead to system instability and security breaches. It is crucial to update to the patched version to mitigate these risks. Implementing workarounds can provide temporary relief, but timely updates are essential for long-term security.
See every vulnerability recorded for dnsmasq →
FAQ
A heap buffer overflow is a type of vulnerability that occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
If exploited, this vulnerability can lead to crashes, unauthorized access, or execution of arbitrary code, compromising the security and stability of your system.
Versions of dnsmasq between e1faf705c96352906e5b867cdd772eb2808e394c and cb321709e9f20cd0949aa375dad2b97050394659 are affected. You can check your version using the command 'dnsmasq -v'.
If you cannot update immediately, consider implementing network restrictions and disabling unnecessary features to mitigate the risk until a patch can be applied.
You can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can also check if your application is affected by this vulnerability using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for dnsmasq.
