CVE-2026-4891: High severity Dnsmasq Dnsmasq vulnerability
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
Other sources
In validaterrset() at dnssec.c:546, siglen is calculated as rdlen - (p - psav) without checking that rdlen is large enough to cover the fixed RRSIG fields and signer name. A crafted RRSIG with a short rdlen makes siglen go negative, which when passed as a size parameter becomes a huge unsigned value, causing a massive heap OOB read. Fix: check siglen <= 0 and return STATBOGUS before using it.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dnsmasqto a version that resolves this vulnerability.Fixed in 2.90-4~deb12u2Fixed in 2.91-1+deb13u1Fixed in 2.92-5 - Compensating control
Apply the described fix in dnsmasq DNSSEC validation: in validate_rrset() in dnssec.c:546, check that sig_len <= 0; if so, return STAT_BOGUS before using sig_len as a size parameter.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4891?
CVE-2026-4891 has a high severity rating due to its potential to cause a denial of service.
How do I fix CVE-2026-4891?
To address CVE-2026-4891, update to dnsmasq versions 2.90-4~deb12u2, 2.91-1+deb13u1, or 2.92-5.
Who is affected by CVE-2026-4891?
CVE-2026-4891 affects users of dnsmasq versions up to 2.85-1, including certain Debian packages.
What type of vulnerability is CVE-2026-4891?
CVE-2026-4891 is classified as a heap-based out-of-bounds read vulnerability.
Can CVE-2026-4891 be exploited remotely?
Yes, CVE-2026-4891 can be exploited remotely through a crafted DNS packet.