The dnsmasq packages in Red Hat Enterprise Linux 10 contain several security flaws: a heap buffer overflow via NAME_ESCAPE expansion (CVE-2026-2291), an infinite loop in NSEC bitmap parsing (CVE-2026-4890), a heap out-of-bounds read caused by RRSIG rdlen underflow (CVE-2026-4891), a DHCPv6 CLID buffer overflow in a helper process (CVE-2026-4892), a broken ECS source validation bypass (CVE-2026-4893), and an out-of-bounds read in extract_addresses() due to malformed rdlen (CVE-2026-5172). These vulnerabilities affect DNS forwarding and DHCP server components, potentially impacting system stability and security. Red Hat has released an important security update to address these issues across multiple architectures and extended support versions.

The vulnerabilities could lead to heap buffer overflows, infinite loops, and out-of-bounds memory reads, which may cause denial of service or potentially allow an attacker to execute arbitrary code or bypass validation mechanisms within the dnsmasq service. The advisory rates the overall security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released an updated dnsmasq package that addresses all listed vulnerabilities. Users running affected versions of Red Hat Enterprise Linux 10 should apply the update as detailed in the Red Hat advisory RHSA-2026:19158 and the referenced article https://access.redhat.com/articles/11258. Applying this official patch is the recommended and effective mitigation. No additional vendor-recommended mitigations or workarounds are indicated.