CVE-2026-4890: High severity Dnsmasq Dnsmasq vulnerability
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
Other sources
NSEC/NSEC3 bitmap window iteration in dnssec.c advances by p[1] instead of p[1] + 2, missing the 2-byte window header. When bitmaplength=0, neither rdlen nor p change, creating an infinite loop. Two instances at dnssec.c:1290 and dnssec.c:1450. Reachable before RRSIG validation so no valid signatures are needed. One of the two sites was coincidentally fixed in 2.92. Fix: add +2 to both the pointer advance and rdlen decrement.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dnsmasqto a version that resolves this vulnerability.Fixed in 2.90-4~deb12u2Fixed in 2.91-1+deb13u1Fixed in 2.92-5 - Upgrade
Upgrade
dnsmasqto a version that resolves this vulnerability.Fixed in 2.92 - Configuration
In dnssec.c at the two instances (dnssec.c:1290 and dnssec.c:1450), adjust NSEC/NSEC3 bitmap window iteration so it advances by p[1] + 2 (not p[1]) and decrements rdlen by the corresponding amount (add +2 to both operations) to account for the missing 2-byte window header.
dnssec.c (dnsmasq DNSSEC validation) pointer advance and rdlen decrement in NSEC/NSEC3 bitmap window iteration = +2 to both the pointer advance and rdlen decrement - Compensating control
Add/ensure a guard in dnssec.c so that when bitmap_length=0, the loop terminates (avoid the infinite loop where neither rdlen nor p change).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4890?
CVE-2026-4890 is classified as a Denial of Service (DoS) vulnerability that can disrupt DNS services.
How do I fix CVE-2026-4890?
To fix CVE-2026-4890, update dnsmasq to version 2.90-4~deb12u2, 2.91-1+deb13u1, or 2.92-5.
Which versions of dnsmasq are affected by CVE-2026-4890?
CVE-2026-4890 affects dnsmasq versions up to and including 2.85-1, 2.85-1+deb11u1, 2.90-4~deb12u1, 2.91-1, and 2.92-4.
Can CVE-2026-4890 be exploited remotely?
Yes, CVE-2026-4890 can be exploited by remote attackers through a crafted DNS packet.
What impact does CVE-2026-4890 have on systems?
CVE-2026-4890 can lead to a denial of service, rendering DNS resolution unavailable for affected systems.