The dnsmasq packages in Red Hat Enterprise Linux 9 contain several security vulnerabilities: a heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291), an infinite loop in NSEC bitmap parsing (CVE-2026-4890), a heap out-of-bounds read due to RRSIG rdlen underflow (CVE-2026-4891), a DHCPv6 CLID buffer overflow in the helper process (CVE-2026-4892), and a broken ECS source validation bypass (CVE-2026-4893). These issues affect the dnsmasq DNS forwarder and DHCP server components and have been rated as important by Red Hat Product Security. Updated dnsmasq packages have been released to address these vulnerabilities across multiple supported architectures and variants of Red Hat Enterprise Linux 9.

The vulnerabilities could lead to heap buffer overflows, infinite loops causing potential denial of service, out-of-bounds memory reads, and bypass of source validation in DNS and DHCP services. These issues may affect system stability and security by enabling attackers to cause crashes or potentially execute arbitrary code or bypass security controls. The advisory rates the impact as important, indicating significant risk if unpatched.

Red Hat has released updated dnsmasq packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:19373 and the referenced article https://access.redhat.com/articles/11258. The update is available for multiple architectures including x86_64, aarch64, s390x, and ppc64le. Applying these official patches is the recommended mitigation. No indication of alternative or temporary mitigations is provided.