DEBIAN-CVE-2026-93011: Medium severity debian/dnsmasq vulnerability
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only dnsmasq builds with DNSSEC support compiled in and DNSSEC enabled at runtime are affected. DNSSEC support is not compiled in by default, so default builds are not exposed through this code path.
What must an attacker be able to do to exploit it?
An attacker must be able to cause the dnsmasq server to validate a crafted DNSSEC response. Exploitation does not require authentication or user interaction.
What is the potential impact?
The crafted response can cause the DNSSEC validator to write a few bytes beyond a domain-name buffer, potentially overwriting a small amount of adjacent heap metadata. The reported impact is integrity loss; no confidentiality or availability impact is indicated.