Loading vulnerability…
CVE-2026-5172 is a memory-safety vulnerability in dnsmasq affecting the extract_addresses() function during processing of DNS replies. A malformed DNS response can cause extract_name() to advance an internal parsing pointer past the end of the current record, after which extract_addresses() performs a heap out-of-bounds read. The flaw has been described as a buffer overflow condition in dnsmasq’s DNS response parsing logic, but the observed consequence documented here is an out-of-bounds read on heap memory that can crash the daemon while handling specially crafted DNS data.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a dnsmasq vulnerability verification toolkit centered on CVE-2026-2291, CVE-2026-5172, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, and CVE-2026-4893. It is not tied to a common exploit framework. The repository contains four functional scripts plus documentation: (1) dnsmasq_cve_verify.py is the primary end-to-end black-box verifier that runs from a testing laptop, starts a malicious DNS service, sends trigger traffic to the DUT, and uses SSH to inspect dnsmasq state and logs before issuing PASS/FAIL verdicts; (2) malicious_dns_server.py is a standalone UDP DNS server that returns crafted malformed responses for manual reproduction of selected parser bugs, notably CVE-2026-5172 and DNSSEC-related issues; (3) test_dnsmasq_cve_remote.py is a lightweight remote detection script that queries version.bind over UDP/53 and infers vulnerability status from the reported dnsmasq version; and (4) test_dnsmasq_cve_on_device.sh is a shell-based local checker that runs on the target device and uses version/strings heuristics to assess patch status and feature applicability. The main exploit capability is network-based triggering of dnsmasq parsing flaws through malicious DNS responses. The code crafts malformed CNAME/rdlen combinations, DNSSEC/NSEC/RRSIG-related records, and ECS-related inputs to induce crashes, hangs, or logic bypasses in vulnerable dnsmasq builds. The README also describes a DHCPv6 CLID overflow test for CVE-2026-4892, which is a local/adjacent vector requiring DHCPv6 support and dhcp-script configuration. The repository therefore mixes active exploit-style verification with auxiliary detection scripts. Because payloads are hardcoded and purpose-built for QA verification rather than generalized post-exploitation, the maturity is best classified as OPERATIONAL rather than weaponized. Fingerprintable observables include the default DUT IP 192.168.1.1, example attacker IP 10.0.0.211, SSH on TCP/22, DNS on UDP/53, trigger domains such as crash-5172.evil.test and crash-2291.evil.test, the version.bind CHAOS TXT query, and DUT file paths like /etc/dnsmasq.conf, /tmp/resolv.conf.auto, /sbin/dnsmasq, /usr/sbin/dnsmasq, and /var/log/messages*. Overall, the repository’s purpose is QA/security validation of dnsmasq patch status and exploitability in live devices, especially routers or embedded Linux systems using dnsmasq as a DNS forwarder.
This repository is a small standalone Python proof-of-concept for CVE-2026-5172 targeting dnsmasq. It contains two code files: server.py, which implements a malicious UDP DNS server that returns a crafted SRV response with an intentionally inconsistent RDLEN field, and query_client.py, which sends raw DNS queries to a dnsmasq instance to drive the vulnerable parsing path. The included README.md and dnsmasq.conf show how to configure dnsmasq to forward queries to the malicious upstream server. The exploit flow is: the client sends an SRV query to dnsmasq; dnsmasq forwards upstream; the malicious server replies with an SRV answer whose declared RDLEN is smaller than the actual RDATA length (actual RDATA is 8 bytes, default declared length is 6); dnsmasq then processes the malformed response, attempting to reproduce the claimed buffer overflow in extract_addresses(). Repository structure is minimal and purpose-built: README.md provides setup steps, dnsmasq.conf provides sample forwarding configuration, query_client.py is the trigger client, and server.py is the malformed-response generator. There is no post-exploitation payload, shell, persistence, or framework integration. This is a network-based PoC intended to reproduce a parser/memory corruption condition rather than deliver a secondary payload.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An upstream dnsmasq vulnerability fixed via backport in OpenWrt's dnsmasq package.
A buffer overflow in dnsmasq's extract_addresses() function that can trigger a heap out-of-bounds read and crash dnsmasq via a malformed DNS response.
A buffer overflow in dnsmasq's extract_addresses() function that can trigger a heap out-of-bounds read and crash the service.
A denial-of-service vulnerability in Dnsmasq's extract_addresses() function that can crash the service when parsing malicious DNS responses.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.