Описание
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
A heap out-of-bounds read vulnerability was discovered in dnsmasq's DNSSEC validation. When processing RRSIG records, dnsmasq calculates the signature length by subtracting the fixed field size from the record's declared data length. A crafted RRSIG record with a data length smaller than the fixed fields causes this calculation to underflow, potentially resulting in an out-of-bounds read and process crash.
Отчет
Red Hat Product Security rates this flaw as Important because an unauthenticated remote attacker can crash the dnsmasq daemon, leading to a complete denial of service for network name resolution. In typical Red Hat Enterprise Linux environments, dnsmasq does not enable DNSSEC validation by default, which restricts exposure to deployments where DNSSEC has been explicitly configured. Impact is limited to service availability, with no compromise of data confidentiality or integrity.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | dnsmasq | Will not fix | ||
| Red Hat Enterprise Linux 7 | dnsmasq | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat Enterprise Linux 10 | dnsmasq | Fixed | RHSA-2026:19158 | 19.05.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | dnsmasq | Fixed | RHSA-2026:92677 | 29.10.2026 |
| Red Hat Enterprise Linux 8 | dnsmasq | Fixed | RHSA-2026:20589 | 26.05.2026 |
| Red Hat Enterprise Linux 9 | dnsmasq | Fixed | RHSA-2026:19373 | 19.05.2026 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | dnsmasq | Fixed | RHSA-2026:95093 | 04.11.2026 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | dnsmasq | Fixed | RHSA-2026:95088 | 04.11.2026 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | dnsmasq | Fixed | RHSA-2026:34508 | 01.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
A heap-based out-of-bounds read vulnerability in the DNSSEC validation ...
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
EPSS
7.5 High
CVSS3