DEBIAN-CVE-2026-93009: Medium severity vulnerability
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
Frequently Asked Questions
Which deployments are exposed to this issue?
Dnsmasq instances that process DHCPv6 client hostname FQDN options from local-network clients are exposed. The attack must originate from the local network.
What does an attacker need to exploit the flaw?
No authentication or user interaction is required. An attacker needs only to send a single crafted DHCPv6 packet containing a malformed FQDN option to the affected dnsmasq service.
What is the demonstrated impact?
The demonstrated behavior is a one-byte out-of-bounds read. The extra byte is not sent back to the client or logged, and no crash has been demonstrated.