This vulnerability involves an infinite loop in the dnssec.c library of the dnsmasq service on Red Hat Enterprise Linux 10. An attacker controlling any DNSSEC-signed zone can craft a response that triggers this infinite loop, causing the dnsmasq process to hang and resulting in denial of DNS resolution for clients relying on that service. The issue is classified under CWE-835 (Loop with Unreachable Exit Condition). Red Hat confirms that dnsmasq is required when DNSSEC is in use. No patch or mitigation currently meets Red Hat's standards for ease of use, applicability, or stability. The CVSS v3.1 score is 4.4 (medium severity), with the attack vector being local, requiring high privileges and no user interaction.

The vulnerability causes a denial of service by hanging the dnsmasq process through an infinite loop, leading to loss of DNS resolution for clients. This impacts availability but does not affect confidentiality or integrity. The attack requires local access with high privileges and no user interaction. There are no known exploits in the wild at this time.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates on fixes or mitigations. Since no official fix or workaround is provided, affected systems should consider limiting exposure to untrusted DNSSEC-signed zones or controlling access to the dnsmasq service where possible.