Threats tagged 'ghsa-wpph-r7r5-526c'

A vulnerability in dnsmasq allows cache poisoning when following CNAME records in DNS responses. The resolver caches records for the CNAME target without verifying that those records belong to the authorized zone of the responding server. This flaw affects split-DNS deployments where some domains are sent to specific upstream servers. An attacker controlling such an upstream can inject malicious cache entries for unrelated names, causing clients to receive attacker-chosen addresses. The vulnerability requires specific configurations to exploit and is not mitigated by DNSSEC for unsigned zones.