ZDI-CAN-30607: ZDI-26-584: dnsmasq DNSSEC NSEC/NSEC3 Type Bitmap Processing Infinite Loop Denial-of-Service Vulnerability
Published Aug 13, 2026
·Updated
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of dnsmasq. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-4890.
Affected Software
1 affected component
dnsmasq
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-26-584 - Compensating control
Mitigate the remote denial-of-service risk in dnsmasq (ZDI-26-584) since authentication is not required to exploit; restrict or protect external access to the dnsmasq service to reduce exposure.
Event History
Aug 13, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description