Threats tagged 'ghsa-2jq5-wc7q-j2fc'

A vulnerability in dnsmasq's DNSSEC validator allows a heap out-of-bounds write of 1-3 bytes past a domain-name buffer due to reduced internal buffer sizes. This flaw requires DNSSEC support to be compiled in and enabled at runtime. The overwrite affects adjacent heap metadata but has not been shown to cause crashes or control-flow impacts. The vulnerability is rated medium severity with a CVSS score of 5.3. Mitigations include not enabling DNSSEC validation unless required and restricting dnsmasq to trusted upstream resolvers if DNSSEC is needed.