Описание
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
A denial of service vulnerability was discovered in dnsmasq's DNSSEC validation. When parsing NSEC and NSEC3 bitmap records, the window iteration logic fails to account for the 2-byte window header when advancing through the bitmap data. A specially crafted DNS response with a zero-length bitmap can cause an infinite loop, making dnsmasq unresponsive to all queries.
Отчет
This issue affects deployments with DNSSEC validation enabled (--dnssec). The flaw is reachable before RRSIG signature validation, meaning no valid DNSSEC signatures are required to trigger it. However, the primary impact is limited to denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | dnsmasq | Under investigation | ||
| Red Hat Enterprise Linux 7 | dnsmasq | Under investigation | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Under investigation | ||
| Red Hat Enterprise Linux 10 | dnsmasq | Fixed | RHSA-2026:19158 | 19.05.2026 |
| Red Hat Enterprise Linux 8 | dnsmasq | Fixed | RHSA-2026:20589 | 26.05.2026 |
| Red Hat Enterprise Linux 9 | dnsmasq | Fixed | RHSA-2026:19373 | 19.05.2026 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | dnsmasq | Fixed | RHSA-2026:34508 | 01.07.2026 |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dn ...
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
7.5 High
CVSS3