CVE-2026-93011

Name of the Vulnerable Software and Affected Versions dnsmasq versions prior to 2.93-3.1

Description A flaw exists in the DNSSEC validator where it can write a few bytes past a name buffer during the conversion of names to and from DNS wire format. This occurs due to a reduction in internal domain-name buffer sizes. An attacker can exploit this by causing the server to validate a crafted DNSSEC response, potentially overwriting a small amount of adjacent heap metadata. DNSSEC support must be compiled in and enabled at runtime for this issue to be present.

Recommendations Update to version 2.93-3.1.