p PatchFirst

CVE-2026-12725

CVE-2026-12725 · Dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

CVSS 5.9 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • red hat openshift container platform 4

    No fix published

  • dnsmasq Debian:12

    Versions
    • 2.89-1
    • 2.90-1
    • 2.90-2
    • 2.90-3
    • 2.90-4
    • 2.90-4~deb12u1
    • 2.90-4~deb12u2
    • 2.90-5
    • 2.90-6
    • 2.90-7
    • 2.91-1
    • 2.91~test6-1
    • 2.91~test9-1
    • 2.92-1
    • 2.92-1+exp1
    • 2.92-1~exp1
    • 2.92-2
    • 2.92-3
    • 2.92-4
    • 2.92-5
    • 2.92~rc1-1
    • 2.92~rc3-1
    • 2.93-1
    • 2.93-2
    • 2.93-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsmasq Debian:13

    Versions
    • 2.91-1
    • 2.91-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 2.91-1+deb13u2

    Update to 2.91-1+deb13u2

  • dnsmasq Debian:14

    Versions
    • 2.91-1
    • 2.92-1
    • 2.92-1+exp1
    • 2.92-1~exp1
    • 2.92-2
    • 2.92-3
    • 2.92-4
    • 2.92-5
    • 2.92~rc1-1
    • 2.92~rc3-1
    Affected ranges
    • ECOSYSTEM: < 2.93-1

    Update to 2.93-1

  • dnsmasq Ubuntu:Pro:16.04:LTS

    Versions
    • 2.75-1
    • 2.75-1ubuntu0.16.04.1
    • 2.75-1ubuntu0.16.04.2
    • 2.75-1ubuntu0.16.04.3
    • 2.75-1ubuntu0.16.04.4
    • 2.75-1ubuntu0.16.04.5
    • 2.75-1ubuntu0.16.04.7
    • 2.75-1ubuntu0.16.04.8
    • 2.75-1ubuntu0.16.04.10
    • 2.75-1ubuntu0.16.04.10+esm1
    • 2.79-1ubuntu0.16.04.1+esm1
    • 2.79-1ubuntu0.16.04.1+esm2
    • 2.90-0ubuntu0.16.04.1+esm1
    • 2.90-0ubuntu0.16.04.1+esm3
    Affected ranges
    • ECOSYSTEM: < 2.90-0ubuntu0.16.04.1+esm4

    Update to 2.90-0ubuntu0.16.04.1+esm4

  • dnsmasq Ubuntu:Pro:18.04:LTS

    Versions
    • 2.78-1
    • 2.78-3
    • 2.79-1
    • 2.79-1ubuntu0.2
    • 2.79-1ubuntu0.3
    • 2.79-1ubuntu0.4
    • 2.79-1ubuntu0.5
    • 2.79-1ubuntu0.6
    • 2.79-1ubuntu0.7
    • 2.90-0ubuntu0.18.04.1+esm1
    • 2.90-0ubuntu0.18.04.1+esm3
    Affected ranges
    • ECOSYSTEM: < 2.90-0ubuntu0.18.04.1+esm4

    Update to 2.90-0ubuntu0.18.04.1+esm4

  • dnsmasq Ubuntu:Pro:20.04:LTS

    Versions
    • 2.80-1ubuntu2
    • 2.80-1ubuntu4
    • 2.80-1.1ubuntu1
    • 2.80-1.1ubuntu1.2
    • 2.80-1.1ubuntu1.3
    • 2.80-1.1ubuntu1.4
    • 2.80-1.1ubuntu1.5
    • 2.80-1.1ubuntu1.6
    • 2.80-1.1ubuntu1.7
    • 2.90-0ubuntu0.20.04.1
    • 2.90-0ubuntu0.20.04.1+esm2
    Affected ranges
    • ECOSYSTEM: < 2.90-0ubuntu0.20.04.1+esm3

    Update to 2.90-0ubuntu0.20.04.1+esm3

  • dnsmasq Ubuntu:22.04:LTS

    Versions
    • 2.85-1ubuntu2
    • 2.86-1.1
    • 2.86-1.1ubuntu0.1
    • 2.86-1.1ubuntu0.2
    • 2.86-1.1ubuntu0.3
    • 2.86-1.1ubuntu0.4
    • 2.86-1.1ubuntu0.5
    • 2.90-0ubuntu0.22.04.1
    • 2.90-0ubuntu0.22.04.3
    Affected ranges
    • ECOSYSTEM: < 2.90-0ubuntu0.22.04.4

    Update to 2.90-0ubuntu0.22.04.4

  • dnsmasq Ubuntu:24.04:LTS

    Versions
    • 2.89-1
    • 2.90-2
    • 2.90-2build1
    • 2.90-2build2
    • 2.90-2ubuntu0.1
    • 2.90-2ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 2.90-2ubuntu0.4

    Update to 2.90-2ubuntu0.4

  • dnsmasq Ubuntu:25.10

    Versions
    • 2.91-1
    • 2.91-1build1
    • 2.91-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsmasq Ubuntu:26.04:LTS

    Versions
    • 2.91-1build1
    • 2.92~rc3-1
    • 2.92-1
    • 2.92-1ubuntu0.2
    • 2.92-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 2.92-1ubuntu0.4

    Update to 2.92-1ubuntu0.4

Original sources

Check your server →