AZL-112421: CVE-2026-93011 affecting package dnsmasq 2.93-1

Q: Are default dnsmasq deployments affected?

DNSSEC support is not compiled in by default, so installations using the default build configuration are not affected. Even where DNSSEC support is compiled in, it must also be enabled at runtime for the issue to be reachable.

Q: What does an attacker need to exploit this issue?

An attacker must be able to cause the server to validate a crafted DNSSEC response. The vulnerable path is reached while the DNSSEC validator converts domain names to and from DNS wire format.

Q: What can be done if an update cannot be applied immediately?

Disable DNSSEC at runtime where it is enabled. Systems whose dnsmasq build does not include DNSSEC support are not exposed to this validator path.

Published Oct 29, 2026

Updated

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

Affected Software

1 affected component

azure-linux/dnsmasq<=2.93-1

Event History

Oct 29, 2026

Advisory Published

via OSV·01:17 PM

Data Sourced

via OSV·01:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93011

Frequently Asked Questions

Are default dnsmasq deployments affected?

DNSSEC support is not compiled in by default, so installations using the default build configuration are not affected. Even where DNSSEC support is compiled in, it must also be enabled at runtime for the issue to be reachable.

What does an attacker need to exploit this issue?

An attacker must be able to cause the server to validate a crafted DNSSEC response. The vulnerable path is reached while the DNSSEC validator converts domain names to and from DNS wire format.

What can be done if an update cannot be applied immediately?

Disable DNSSEC at runtime where it is enabled. Systems whose dnsmasq build does not include DNSSEC support are not exposed to this validator path.

AZL-112421: CVE-2026-93011 affecting package dnsmasq 2.93-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Are default dnsmasq deployments affected?

What does an attacker need to exploit this issue?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Are default dnsmasq deployments affected?

What does an attacker need to exploit this issue?

What can be done if an update cannot be applied immediately?