CVE-2026-12969 — Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation

Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

USN-8542-1 — dnsmasq vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: dnsmasq, Ubuntu:Pro:18.04:LTS: dnsmasq, Ubuntu:Pro:20.04:LTS: dnsmasq, Ubuntu:22.04:LTS: dnsmasq, Ubuntu:24.04:LTS: dnsmasq, Ubuntu:26.04:LTS: dnsmasq

Yiwei Hou discovered that Dnsmasq incorrectly handled logging of DS or DNSKEY. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-12725)

It was discovered that Dnsmasq incorrectly validated the length of fixed-length DNS record fields when parsing NS section records. A remote attacker could possibly use this issue to cause Dnsmasq to read out of bounds, possibly exposing sensitive information. (CVE-2026-12969)

Most recent entries from all

CVE-2026-12969 — Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation

USN-8542-1 — dnsmasq vulnerabilities