Critical Security Update for dnsmasq: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:20589: Important: dnsmasq security update. Affects dnsmasq versions < 2.79-36.el8_10. Fixed in 2.79-36.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dnsmasq is a lightweight DNS forwarder and DHCP server widely used in network configurations. It provides essential services for managing IP addresses and domain name resolution in small networks. However, recent vulnerabilities have been identified that could compromise its functionality and security, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerabilities in dnsmasq include a heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291), an infinite loop in NSEC bitmap parsing (CVE-2026-4890), an RRSIG rdlen underflow leading to heap out-of-bounds read (CVE-2026-4891), a DHCPv6 CLID buffer overflow in the helper process (CVE-2026-4892), and a broken ECS source validation bypass (CVE-2026-4893). These issues could lead to denial of service, unauthorized access, or data leakage, making it critical to address them promptly.
How To Fix
Minimum fixed version
2.79-36.el8_10
This is the first release that contains the fix.
sudo dnf update dnsmasqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the affected features in dnsmasq until the update is applied. This may involve modifying the configuration files to limit DNS and DHCP functionalities, but specific instructions will depend on your current setup.
Conclusion
The recent vulnerabilities in dnsmasq pose serious security risks that require immediate attention. By updating to the latest patched version and considering temporary workarounds, users can protect their systems from potential exploits. Regular monitoring and vulnerability assessments are essential for maintaining network security.
See every vulnerability recorded for dnsmasq →
FAQ
Dnsmasq is a lightweight DNS forwarder and DHCP server that simplifies the management of network services.
The vulnerabilities could lead to denial of service, unauthorized access, or data leakage, posing significant risks to network security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, consider disabling the affected features or implementing network segmentation to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for dnsmasq.
