RHSA-2026:96246: Important: dnsmasq security, bug fix, and enhancement update
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.Security Fix(es): dnsmasq: dnsmasq: heap buffer overflow in cache via NAMEESCAPE expansion (CVE-2026-2291) dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) Bug Fix(es) and Enhancement(s): dnsmasq: New DNSSEC trust anchor key 2024 (JIRA:RHEL-272334) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/dnsmasqto a version that resolves this vulnerability.Fixed in 2.79-26.el8_8.5 - Upgrade
Upgrade
redhat/dnsmasq-debuginfoto a version that resolves this vulnerability.Fixed in 2.79-26.el8_8.5 - Upgrade
Upgrade
redhat/dnsmasq-debugsourceto a version that resolves this vulnerability.Fixed in 2.79-26.el8_8.5 - Upgrade
Upgrade
redhat/dnsmasq-utilsto a version that resolves this vulnerability.Fixed in 2.79-26.el8_8.5 - Upgrade
Upgrade
redhat/dnsmasq-utils-debuginfoto a version that resolves this vulnerability.Fixed in 2.79-26.el8_8.5
Event History
Frequently Asked Questions
Which issues in this update are memory-safety vulnerabilities?
CVE-2026-2291 is a heap buffer overflow in cache handling through NAME_ESCAPE expansion. CVE-2026-4891 causes a heap out-of-bounds read through RRSIG rdlen underflow, and CVE-2026-4892 is a DHCPv6 CLID buffer overflow in a helper process.
Does the update include changes beyond the listed security fixes?
Yes. It adds a new DNSSEC trust anchor key for 2024.