This vulnerability arises from a flow in the dnssec.c library that leads to an infinite loop in the dnsmasq service when parsing crafted DNSSEC-signed zone responses. An attacker who controls any DNSSEC-signed zone can exploit this by sending a single malicious response that causes dnsmasq to enter an infinite loop, effectively hanging the process and disrupting DNS resolution for clients. The issue is classified under CWE-835 (Loop with Unreachable Exit Condition). Red Hat confirms the dnsmasq component is required for DNSSEC service installations. No official fix or mitigation currently meets Red Hat's standards for ease of use, deployment, or stability.

The vulnerability causes a denial of service by hanging the dnsmasq process, which stops DNS resolution for clients relying on it. This results in resource exhaustion (CPU and memory) due to the infinite loop. There is no impact on confidentiality or integrity, but availability is severely affected. The CVSS v3.1 score is 4.4 (medium severity), with the attack vector being local, requiring high privileges, and no user interaction needed.

Red Hat states that no mitigation is currently available or meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates or fixes. Until a fix is released, affected systems remain vulnerable to denial of service via crafted DNSSEC responses. Customers with a Technical Account Manager (TAM) can consult directly for guidance. No official patch or workaround is currently provided.