CVE-2026-93011: Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
Other sources
A heap out-of-bounds write was found in dnsmasq's DNSSEC validator, as a follow-on to the buffer reduction in commit 014e909 (CVE-2026-2291). That commit shrank domain-name buffers from 2051 bytes to MAXDNAMESTR+1 (504 bytes). The in-place towire() and fromwire() transforms in src/rrfilter.c were not given length parameters and can write 1-3 bytes past a 504-byte buffer when processing near-maximal names during DNSSEC validation (wildcard stripping in validaterrset, and NSEC3 hashname round-trip).
This is a distinct issue from CVE-2026-2291. CVE-2026-2291 was the original storage-allocation rework. This finding is an OOB write that became reachable after that shrink.
The overwrite lands on adjacent heap chunk metadata of a startup allocation that is never freed. Reporter observed zero crashes in 120 trigger attempts. HAVEDNSSEC is commented out by default (config.h). Runtime requires --dnssec and --trust-anchor.
Affected versions: v2.93 through HEAD. Unaffected: v2.92 and earlier (2051-byte name buffers). Standalone CVE-2026-2291.diff on v2.91/v2.92 does not shrink these buffers and is not affected by this follow-on. Fix: Not yet available (reporter coordinating with upstream). Reporter: Shubham Raj (Causal Security) PSIRT Ticket: PSIRTSUPT-23743
— Red Hat
Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via towire/fromwire transforms
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dnsmasqto a version that resolves this vulnerability.Fixed in v2.92 - Configuration
Keep HAVE_DNSSEC disabled and do not enable DNSSEC validation with --dnssec and --trust-anchor, since the vulnerable code requires DNSSEC support and runtime validation to be enabled.
dnsmasq DNSSEC support and runtime validation = disabled