Vulnerability record/PUBLISHED/Published Oct 29, 2026 12:47:10 UTC
CVE-2026-93011
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
Base score5.3/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 6, 2026 01:50:37 UTC
PublishedOct 29, 2026 12:47:10 UTC
ReservedSep 17, 2026 14:35:34 UTC
Credits
- Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.