Red Hat Security Advisory: dnsmasq security update
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
The dnsmasq packages in Red Hat Enterprise Linux 10 contain several security flaws: a heap buffer overflow via NAME_ESCAPE expansion (CVE-2026-2291), an infinite loop in NSEC bitmap parsing (CVE-2026-4890), a heap out-of-bounds read due to RRSIG rdlen underflow (CVE-2026-4891), a DHCPv6 CLID buffer overflow in the helper process (CVE-2026-4892), a broken ECS source validation bypass (CVE-2026-4893), and an out-of-bounds read in extract_addresses() via malformed rdlen (CVE-2026-5172). These vulnerabilities affect the dnsmasq DNS forwarder and DHCP server components. Red Hat has released updated packages to address these issues.
Potential Impact
These vulnerabilities could lead to memory corruption issues such as heap buffer overflows and out-of-bounds reads, potentially causing crashes or other unintended behavior in dnsmasq. The broken ECS source validation bypass could allow evasion of source validation mechanisms. The infinite loop could cause denial of service. The overall impact is rated as important by Red Hat, indicating significant security concerns.
Mitigation Recommendations
Red Hat has released updated dnsmasq packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:19158. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.
Red Hat Security Advisory: dnsmasq security update
Description
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The dnsmasq packages in Red Hat Enterprise Linux 10 contain several security flaws: a heap buffer overflow via NAME_ESCAPE expansion (CVE-2026-2291), an infinite loop in NSEC bitmap parsing (CVE-2026-4890), a heap out-of-bounds read due to RRSIG rdlen underflow (CVE-2026-4891), a DHCPv6 CLID buffer overflow in the helper process (CVE-2026-4892), a broken ECS source validation bypass (CVE-2026-4893), and an out-of-bounds read in extract_addresses() via malformed rdlen (CVE-2026-5172). These vulnerabilities affect the dnsmasq DNS forwarder and DHCP server components. Red Hat has released updated packages to address these issues.
Potential Impact
These vulnerabilities could lead to memory corruption issues such as heap buffer overflows and out-of-bounds reads, potentially causing crashes or other unintended behavior in dnsmasq. The broken ECS source validation bypass could allow evasion of source validation mechanisms. The infinite loop could cause denial of service. The overall impact is rated as important by Red Hat, indicating significant security concerns.
Mitigation Recommendations
Red Hat has released updated dnsmasq packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:19158. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:19158
- Cve Count
- 6
- Additional Cves
- ["CVE-2026-4890","CVE-2026-4891","CVE-2026-4892","CVE-2026-4893","CVE-2026-5172"]
Threat ID: 6a16097de29bf47b50649db8
Added to database: 05/26/2026, 20:58:37 UTC
Last enriched: 08/13/2026, 19:46:45 UTC
Last updated: 09/14/2026, 22:01:33 UTC
Views: 139
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.