RHSA-2026:95093: Important: dnsmasq security, bug fix, and enhancement update
Important: dnsmasq security, bug fix, and enhancement update
Other sources
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.Security Fix(es): dnsmasq: dnsmasq: heap buffer overflow in cache via NAMEESCAPE expansion (CVE-2026-2291) dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) Bug Fix(es) and Enhancement(s): dnsmasq: New DNSSEC trust anchor key 2024 (JIRA:RHEL-249260) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/dnsmasqto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5 - Upgrade
Upgrade
redhat/dnsmasq-debuginfoto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5 - Upgrade
Upgrade
redhat/dnsmasq-debugsourceto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5 - Upgrade
Upgrade
redhat/dnsmasq-utilsto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5 - Upgrade
Upgrade
redhat/dnsmasq-utils-debuginfoto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5 - Upgrade
Upgrade
redhat/dnsmasqto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5.aa - Upgrade
Upgrade
redhat/dnsmasq-debuginfoto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5.aa - Upgrade
Upgrade
redhat/dnsmasq-debugsourceto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5.aa - Upgrade
Upgrade
redhat/dnsmasq-utilsto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5.aa - Upgrade
Upgrade
redhat/dnsmasq-utils-debuginfoto a version that resolves this vulnerability.Fixed in 2.85-6.el9_2.5.aa
Event History
Frequently Asked Questions
Which dnsmasq components are covered by this update?
The update covers dnsmasq and dnsmasq-utils packages, along with their debuginfo and debugsource packages, for the listed Red Hat Enterprise Linux offerings.
What types of attacks do the security fixes address?
The fixes address a heap buffer overflow in DNS cache processing, an infinite loop in NSEC bitmap parsing, an RRSIG length underflow that can cause an out-of-bounds heap read, a DHCPv6 client identifier buffer overflow in a helper process, and a bypass of ECS source validation.
Does the advisory include changes beyond the security fixes?
Yes. It also adds a new 2024 DNSSEC trust anchor key.