Critical Security Flaw in dnsmasq: Heap Buffer Overflow and Other Vulnerabilities
Summary
ALSA-2026:19373: Important: dnsmasq security update. Affects dnsmasq versions < 2.85-18.el9_8.1. Fixed in 2.85-18.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dnsmasq is a lightweight DNS forwarder and DHCP server that is widely used in various network configurations. It provides essential services such as DNS caching and DHCP address assignment, making it a critical component in many systems. However, recent vulnerabilities have been identified that could potentially compromise the security and stability of systems utilizing dnsmasq.
Vulnerability Detail
The vulnerabilities in dnsmasq include a heap buffer overflow due to NAME_ESCAPE expansion, which can lead to arbitrary code execution. Additionally, there is an infinite loop in NSEC bitmap parsing, an RRSIG rdlen underflow that can cause out-of-bounds reads, a DHCPv6 CLID buffer overflow in the helper process, and a broken ECS source validation bypass. These vulnerabilities could allow attackers to exploit the system, leading to unauthorized access or denial of service.
How To Fix
Minimum fixed version
2.85-18.el9_8.1
This is the first release that contains the fix.
sudo dnf update dnsmasqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the dnsmasq service until the package can be updated. This can be done with the command:
sudo systemctl stop dnsmasq
However, this may disrupt DNS and DHCP services on your network.
Conclusion
The identified vulnerabilities in dnsmasq pose significant risks to systems relying on this package for DNS and DHCP services. It is crucial to update to the latest patched version to safeguard against potential exploits. Monitoring tools like Vulert can assist in managing vulnerabilities effectively.
See every vulnerability recorded for dnsmasq →
FAQ
Dnsmasq is a lightweight DNS forwarder and DHCP server used to provide DNS and DHCP services in network environments.
The vulnerabilities can lead to unauthorized access, arbitrary code execution, and denial of service, potentially compromising system integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, consider disabling the dnsmasq service as a temporary measure to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for dnsmasq.
