The dnsmasq package in Red Hat Enterprise Linux 9 contained multiple vulnerabilities: a heap buffer overflow via NAME_ESCAPE expansion (CVE-2026-2291), an infinite loop in NSEC bitmap parsing (CVE-2026-4890), a heap out-of-bounds read due to RRSIG rdlen underflow (CVE-2026-4891), a DHCPv6 client identifier buffer overflow in a helper process (CVE-2026-4892), and a broken ECS source validation bypass (CVE-2026-4893). These issues affect the DNS forwarding and DHCP server components of dnsmasq. Red Hat has issued an important security advisory with updated dnsmasq packages to fix these vulnerabilities in Red Hat Enterprise Linux 9 across multiple architectures.

The vulnerabilities could lead to memory corruption issues such as heap buffer overflows and out-of-bounds reads, potentially causing denial of service or other unintended behavior in the dnsmasq service. The broken ECS source validation bypass may allow evasion of expected DNS client subnet validation. The infinite loop vulnerability could cause resource exhaustion. These impacts affect DNS and DHCP services on affected Red Hat Enterprise Linux 9 systems.

Red Hat has released updated dnsmasq packages that address these vulnerabilities. Users should apply the security update for dnsmasq as provided in Red Hat Enterprise Linux 9. Details and update instructions are available in the Red Hat advisory RHSA-2026:19373 and the referenced article https://access.redhat.com/articles/11258. Applying the official update is the recommended remediation.