Debian 11 dnsmasq Critical DoS Heap Overflow Vulnerability DLA-4625-1

debian lts

June 10, 2026

Several vulnerabilities have been discovered in dnsmasq, a caching DNS proxy and DHCP/TFTP server

Topics Covered

security advisory denial of service debian heap overflow attack vector dnsmasq

Summary

CVE-2026-2291

dnsmasqs extract_name() function can be abused to cause a heap buffer
overflow, allowing an attacker to inject false DNS cache entries,
which could result in DNS lookups to redirect to an
attacker-controlled IP address, or to cause a DoS.

CVE-2026-4890

A Denial of Service (DoS) vulnerability in the DNSSEC validation of
dnsmasq allows remote attackers to cause a denial of service via a
crafted DNS packet.

CVE-2026-4891

A heap-based out-of-bounds read vulnerability in the DNSSEC validation
of dnsmasq allows remote attackers to cause a denial of service via a
crafted DNS packet.

CVE-2026-4892

A heap-based out-of-bounds write vulnerability in the DHCPv6
implementation of dnsmasq allows local attackers to execute arbitrary
code with root privileges via a crafted DHCPv6 packet.

CVE-2026-4893

An information disclosure vulnerability in dnsmasq allows remote
attackers to bypass source checks via a crafted DNS packet with RFC