A vulnerability in dnsmasq's TCP DNS service allows remote attackers to exhaust a fixed pool of child processes by opening idle TCP connections to port 53. This prevents new TCP DNS connections and disrupts DNSSEC validation that requires TCP fallback. UDP DNS resolution remains unaffected, and the occupied slots are released after a fixed timeout. The impact is limited to TCP-dependent DNS operations, and the condition auto-recovers unless the attacker maintains connections.