CVE-2026-93008

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.93-3.1

Description A flaw exists in the resolver when following a CNAME in a DNS response. The system may cache records for the CNAME target without verifying if those records belong to the authorized zone of the responding server. In split-DNS deployments—where specific domains are routed to a particular upstream server—an attacker controlling that upstream server can inject cache entries for unrelated names, leading clients to receive attacker-controlled addresses.

Recommendations Update to version 2.93-3.1.