CVE-2026-93007: Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

Q: Which deployments are exposed to this issue?

Dnsmasq instances that accept remote TCP DNS connections on port 53 are exposed. The issue affects the TCP DNS handler; UDP DNS resolution continues to function during an attack.

Q: What does an attacker need to do to cause the denial of service?

An unauthenticated remote attacker only needs network access to TCP port 53. They can open and leave idle TCP connections until the configured child-process pool is exhausted.

Q: How long can the service disruption last?

Occupied child slots are released after the fixed CHILD_LIFETIME of 150 seconds. An attacker can maintain exhaustion by continuing to hold or renew idle connections.

Q: Does the default configuration limit the number of connections involved?

Yes. The child-process pool is bounded by MAX_PROCS, which defaults to 30 and can be configured with --max-tcp-connections. Exhausting that shared pool prevents new TCP DNS connections and DNSSEC operations requiring TCP fallback.

Q: How can an administrator recognize active exploitation?

Affected systems may show idle TCP connections to port 53 consuming all available tcp_pids/tcp_pipes child slots. New TCP DNS requests will fail or stall, while UDP resolution continues and DNSSEC validation needing TCP fallback is abandoned.

Published Sep 17, 2026

Updated

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

Other sources

A resource-exhaustion issue was found in dnsmasq's TCP DNS handler. Incoming TCP connections on port 53 cause fork() of a child process tracked in fixed-size tcppids/tcppipes arrays bounded by MAXPROCS (default 30, configurable via --max-tcp-connections). Children block on readwrite() of the client socket with no SORCVTIMEO. The only timeout is CHILDLIFETIME (150 seconds via SIGALRM).

An unauthenticated remote attacker can open MAXPROCS idle TCP connections and hold all slots for up to 150 seconds. During exhaustion, setdnslisteners() stops polling TCP listen sockets, and DNSSEC swaptotcp() (which shares the same slot pool) returns STATABANDONED. UDP DNS continues to function.

This is a slowloris-style exhaustion of the fork-per-connection TCP architecture. SORCVTIMEO is already applied to upstream server sockets (forward.c) but not to accepted client sockets.

Affected versions: all current versions (fundamental TCP architecture). Fix: Not yet available (reporter coordinating with upstream). Reporter: Shubham Raj (Causal Security) PSIRT Ticket: PSIRTSUPT-23743

— Red Hat

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

— Microsoft

Affected Software

12 affected components

debian/dnsmasq*

debian/dnsmasq<=2.90-4~deb12u2, <=2.91-1+deb13u2, <=2.91-1+deb13u1, <=2.93-3

ubuntu/dnsmasq*

Event History

Sep 17, 2026

Data Sourced

via Red Hat·02:47 PM

DescriptionSeverityAffected Software

Oct 29, 2026

CVE Published

via MITRE·12:47 PM

Data Sourced

via MITRE·12:47 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·01:17 PM

DescriptionSeverityAffected Software

Nov 3, 2026

Data Sourced

via Microsoft·09:05 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Dnsmasq instances that accept remote TCP DNS connections on port 53 are exposed. The issue affects the TCP DNS handler; UDP DNS resolution continues to function during an attack.

What does an attacker need to do to cause the denial of service?

An unauthenticated remote attacker only needs network access to TCP port 53. They can open and leave idle TCP connections until the configured child-process pool is exhausted.

How long can the service disruption last?

Occupied child slots are released after the fixed CHILD_LIFETIME of 150 seconds. An attacker can maintain exhaustion by continuing to hold or renew idle connections.

Does the default configuration limit the number of connections involved?

Yes. The child-process pool is bounded by MAX_PROCS, which defaults to 30 and can be configured with --max-tcp-connections. Exhausting that shared pool prevents new TCP DNS connections and DNSSEC operations requiring TCP fallback.

How can an administrator recognize active exploitation?

Affected systems may show idle TCP connections to port 53 consuming all available tcp_pids/tcp_pipes child slots. New TCP DNS requests will fail or stall, while UDP resolution continues and DNSSEC validation needing TCP fallback is abandoned.

CVE-2026-93007: Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

Other sources

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to cause the denial of service?

How long can the service disruption last?

Does the default configuration limit the number of connections involved?

How can an administrator recognize active exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to cause the denial of service?

How long can the service disruption last?

Does the default configuration limit the number of connections involved?

How can an administrator recognize active exploitation?