Red Hat Security Advisory: dnsmasq security update
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
The dnsmasq package version 2.85-17.el9_6.1 in Red Hat Enterprise Linux 9.6 Extended Update Support contains multiple security flaws: a heap buffer overflow via NAME_ESCAPE expansion (CVE-2026-2291), an infinite loop in NSEC bitmap parsing (CVE-2026-4890), a heap out-of-bounds read due to RRSIG rdlen underflow (CVE-2026-4891), a DHCPv6 client identifier buffer overflow in the helper process (CVE-2026-4892), and a broken ECS source validation bypass (CVE-2026-4893). These vulnerabilities have been addressed by Red Hat through updated packages as detailed in advisory RHSA-2026:20589.
Potential Impact
These vulnerabilities collectively pose a critical security risk, potentially allowing remote attackers to cause denial of service conditions (e.g., infinite loops), memory corruption (heap buffer overflow and out-of-bounds read), and bypass of source validation mechanisms. Such issues could lead to remote code execution or other severe impacts if exploited. The advisory rates the overall impact as important, with the severity tagged as critical.
Mitigation Recommendations
Red Hat has released updated dnsmasq packages to fix these vulnerabilities. Users of the affected version (=2.85-17.el9_6.1) should apply the security update as soon as possible following Red Hat's official guidance at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual update of the affected packages. No indication of 'no action required' or 'already mitigated' is present, so patching is recommended.
Red Hat Security Advisory: dnsmasq security update
Description
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The dnsmasq package version 2.85-17.el9_6.1 in Red Hat Enterprise Linux 9.6 Extended Update Support contains multiple security flaws: a heap buffer overflow via NAME_ESCAPE expansion (CVE-2026-2291), an infinite loop in NSEC bitmap parsing (CVE-2026-4890), a heap out-of-bounds read due to RRSIG rdlen underflow (CVE-2026-4891), a DHCPv6 client identifier buffer overflow in the helper process (CVE-2026-4892), and a broken ECS source validation bypass (CVE-2026-4893). These vulnerabilities have been addressed by Red Hat through updated packages as detailed in advisory RHSA-2026:20589.
Potential Impact
These vulnerabilities collectively pose a critical security risk, potentially allowing remote attackers to cause denial of service conditions (e.g., infinite loops), memory corruption (heap buffer overflow and out-of-bounds read), and bypass of source validation mechanisms. Such issues could lead to remote code execution or other severe impacts if exploited. The advisory rates the overall impact as important, with the severity tagged as critical.
Mitigation Recommendations
Red Hat has released updated dnsmasq packages to fix these vulnerabilities. Users of the affected version (=2.85-17.el9_6.1) should apply the security update as soon as possible following Red Hat's official guidance at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual update of the affected packages. No indication of 'no action required' or 'already mitigated' is present, so patching is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:20589
- Cve Count
- 5
- Additional Cves
- ["CVE-2026-4890","CVE-2026-4891","CVE-2026-4892","CVE-2026-4893"]
Threat ID: 6a16097ce29bf47b50648826
Added to database: 05/26/2026, 20:58:36 UTC
Last enriched: 08/07/2026, 05:52:29 UTC
Last updated: 09/14/2026, 10:01:30 UTC
Views: 220
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.