Loading story…
CERT/CC and the dnsmasq maintainer disclosed six vulnerabilities in dnsmasq that affect most supported, non-legacy versions and can lead to DNS cache poisoning, denial of service, information disclosure, security-control bypass, heap manipulation, and local privilege escalation. The issues are tracked as CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893, and CVE-2026-5172, and stem from flaws in memory safety, input validation, DNSSEC handling, DHCPv6, and DNS parsing. Several attack paths are remote via crafted DNS packets or malformed DNS responses, while CVE-2026-4892 is a heap-based out-of-bounds write in DHCPv6 that can let a local attacker execute arbitrary code as root with a crafted packet.
Maintainer Simon Kelley released dnsmasq 2.92rel2 with backported fixes for the stable branch and indicated the fixes are incorporated into version 2.93, which CERT/CC lists as fixed. Vendor remediation followed quickly, including a Debian security update (DSA 6264-1), and additional vendors were expected to publish patched packages. The disclosure drew attention because dnsmasq is widely deployed in routers, Linux systems, and embedded environments, making prompt patching important wherever the service is exposed to untrusted DNS or local network traffic.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Debian published security advisory DSA-6264-1 to provide patched dnsmasq packages for the disclosed vulnerabilities. This reflected downstream vendor remediation following the coordinated disclosure.
The CVE record for CVE-2026-4892 was updated on May 11, 2026 with a description of a heap-based out-of-bounds write in dnsmasq's DHCPv6 implementation that could allow local root code execution via a crafted DHCPv6 packet. References and a CVSS v3.1 vector were also added.
On May 11, 2026, CERT/CC publicly disclosed six dnsmasq vulnerabilities: CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893, and CVE-2026-5172. The issues included DNS cache poisoning, denial of service, information disclosure, security-control bypass, and local privilege escalation.
Dnsmasq maintainer Simon Kelley announced release 2.92rel2 for the stable 2.92 branch with patches for the newly disclosed vulnerabilities. He also indicated fixes would be incorporated into the upcoming 2.93 release cycle.
CERT/CC published advisory VU#471747 covering multiple dnsmasq flaws that could enable attacker-controlled DNS redirection, privilege escalation, and heap manipulation. The advisory later served as the central reference for the coordinated disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
bugflation.com
Open sourceseclists.org
Open sourcehelpnetsecurity.com
Open sourcelists.thekelleys.org.uk
Open sourceseclists.org
Open sourceopennet.me
Open sourcekb.cert.org
Open sourcekb.cert.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A heap buffer overflow in **Dnsmasq** tracked as `CVE-2026-2291` can be triggered when the resolver processes malicious DNS replies from an upstream DNS server, allowing memory corruption, false cache entry injection, DNS redirection, and denial of service. The flaw affects code introduced in release `2.73` and is tied to unsafe `strcpy()` use during cache insertion after `extract_name()` converts DNS names from wire format into C strings, where escaped names can exceed the `1,025`-byte `bigname` heap buffer. Researchers reported practical exploitation against **OpenWRT 24.10.4** configured to use a malicious upstream resolver, using crafted requests and CNAME chains to corrupt the `bigname` free list, obtain a write-what-where primitive, and overwrite a function pointer in musl `ld.so` to gain instruction-pointer control. The issue was fixed on 11 May 2026 in versions `2.92rel2` and `2.93`, and public reporting warns that exposed deployments could face DNS hijacking or, under the demonstrated conditions, full remote code execution.
Jul 20, 2026
Internet Systems Consortium disclosed **nine vulnerabilities** in **BIND 9** and released patched versions **9.20.26** and **9.21.24**. The most severe issue, **`CVE-2026-13321`** (CVSS **8.6**), allows a remotely exploitable **DNSSEC validation bypass** by accepting signed **NSEC** records whose `Next Domain Name` points outside the signer’s zone, enabling cross-zone cache poisoning with authenticated denial responses. ISC also disclosed **`CVE-2026-11721`**, a high-severity **cache poisoning** flaw tied to label-count discrepancies in **RRSIG** and wildcard synthesis, and **`CVE-2026-10723`**, which can let attackers forge authenticated **NXDOMAIN** responses for sibling zones through incorrect acceptance of child-zone **NSEC3** records. ISC said no active exploitation was known at disclosure time and reported no workaround for the affected releases. The remaining flaws include several remotely exploitable **denial-of-service** and **resource exhaustion** bugs affecting DNSSEC-validating resolvers and other BIND components. **`CVE-2026-11622`** can drive memory consumption far beyond configured limits during random-subdomain attacks against DNSSEC-signed zones, while **`CVE-2026-11605`** can force excessive CPU use by making BIND validate unnecessary but valid **RRSIG** records. **`CVE-2026-13204`**, **`CVE-2026-12617`**, and **`CVE-2026-10822`** can cause **`named`** to exit unexpectedly under specific malformed or specially ordered DNS responses, and **`CVE-2026-11331`** can bypass wildcard **RPZ CNAME** policies and also trigger a crash with overly long query names. ISC advised users of affected **9.11**, **9.18**, **9.20**, **9.21**, and Supported Preview Edition branches to upgrade to the nearest patched supported release.
Jul 23, 2026
Internet Systems Consortium (ISC) disclosed six vulnerabilities in **BIND 9** and released patched versions `9.18.49`, `9.20.23`, and `9.21.22`. The issues include **CVE-2026-3039**, a high-severity memory-exhaustion flaw during GSS-API TKEY negotiation that can crash `named`; **CVE-2026-3593**, a high-severity heap use-after-free in the DNS-over-HTTPS implementation triggered by crafted HTTP/2 traffic; **CVE-2026-3592**, an amplification issue involving self-pointed glue records that can drive disproportionate bandwidth and resource consumption; **CVE-2026-5947**, a race condition in SIG(0) validation under query-flood conditions that can lead to undefined behavior and process crashes; plus additional flaws involving invalid handling of `CLASS != IN` and an unbounded resend loop in the resolver. ISC said the vulnerabilities are remotely exploitable in affected configurations, with the most serious impacts centered on denial of service, memory corruption, and resolver abuse rather than confirmed code execution. Exposure depends on feature use: the GSS-API issue is especially relevant to Active Directory-integrated or Kerberos-secured DNS deployments, while the DoH flaw affects only servers with DNS-over-HTTPS enabled and can be mitigated by disabling that feature until upgrades are applied. ISC reported no known active exploitation at disclosure time, said no workaround is known for several of the bugs, and credited external researchers including Vitaly Simonovich, Naoki Wakamatsu, Naresh Kandula Parmar, and Shuhan Zhang for reporting the flaws.
Jun 29, 2026