The dnsmasq packages in Red Hat Enterprise Linux 10 contain multiple security vulnerabilities: a heap buffer overflow via NAME_ESCAPE expansion (CVE-2026-2291), an infinite loop in NSEC bitmap parsing (CVE-2026-4890), a heap out-of-bounds read due to RRSIG rdlen underflow (CVE-2026-4891), a DHCPv6 CLID buffer overflow in the helper process (CVE-2026-4892), a broken ECS source validation bypass (CVE-2026-4893), and an out-of-bounds read in extract_addresses() via malformed rdlen (CVE-2026-5172). These vulnerabilities affect the dnsmasq DNS forwarder and DHCP server components. Red Hat has issued an important security advisory (RHSA-2026:19158) with updated packages to fix these issues in Red Hat Enterprise Linux 10 and its variants.

These vulnerabilities could lead to heap buffer overflows, infinite loops causing denial of service, out-of-bounds memory reads, and bypass of source validation in DNS and DHCP services. Such issues may allow attackers to cause service disruption or potentially execute arbitrary code depending on the vulnerability. The advisory rates the overall impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated dnsmasq packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related variants should apply the security update provided in advisory RHSA-2026:19158 promptly. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.