p PatchFirst

CVE-2026-61477

CVE-2026-61477 · Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

CVSS 2.3 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • red hat enterprise linux for nvidia 26

    No fix published

  • libvirt Debian:12

    Versions
    • 10.0.0-1
    • 10.0.0-2
    • 10.0.0-3
    • 10.1.0-1
    • 10.10.0-1
    • 10.10.0-2
    • 10.10.0-3
    • 10.10.0-4
    • 10.2.0-1
    • 10.3.0-1
    • 10.3.0-2
    • 10.3.0-3
    • 10.4.0-1
    • 10.5.0-1
    • 10.6.0-1
    • 10.6.0-2
    • 10.6.0-3
    • 10.7.0-1
    • 10.7.0-2
    • 10.7.0-3
    • 10.8.0-1
    • 10.9.0-1
    • 10.9.0-2
    • 11.0.0-1
    • 11.0.0-2
    • 11.1.0-1
    • 11.1.0-2
    • 11.10.0-1
    • 11.10.0-2
    • 11.2.0-1
    • 11.2.0-2
    • 11.2.0-3
    • 11.3.0-1
    • 11.3.0-2
    • 11.3.0-2~bpo12+1
    • 11.3.0-3
    • 11.4.0-1
    • 11.5.0-1
    • 11.6.0-1
    • 11.7.0-1
    • 11.8.0-1
    • 11.8.0-2
    • 11.9.0-1
    • 11.9.0-2
    • 12.0.0-1
    • 12.1.0-1
    • 12.2.0-1
    • 12.3.0-1
    • 12.4.0-1
    • 12.5.0-1
    • 12.6.0-1
    • 12.7.0-1
    • 9.0.0-4
    • 9.0.0-4+deb12u1
    • 9.0.0-4+deb12u2
    • 9.1.0-1
    • 9.10.0-1
    • 9.2.0-1
    • 9.2.0-2
    • 9.3.0-1
    • 9.3.0-2
    • 9.4.0-1
    • 9.5.0-1
    • 9.5.0-2
    • 9.6.0-1
    • 9.6.0-2
    • 9.6.0-3
    • 9.7.0-1
    • 9.8.0-1
    • 9.8.0-2
    • 9.9.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvirt Debian:13

    Versions
    • 11.3.0-3
    • 11.3.0-3+deb13u1
    • 11.3.0-3+deb13u2
    Affected ranges
    • ECOSYSTEM: < 11.3.0-3+deb13u3

    Update to 11.3.0-3+deb13u3

  • libvirt Debian:14

    Versions
    • 11.10.0-1
    • 11.10.0-2
    • 11.3.0-3
    • 11.4.0-1
    • 11.5.0-1
    • 11.6.0-1
    • 11.7.0-1
    • 11.8.0-1
    • 11.8.0-2
    • 11.9.0-1
    • 11.9.0-2
    • 12.0.0-1
    • 12.1.0-1
    • 12.2.0-1
    • 12.3.0-1
    • 12.4.0-1
    • 12.5.0-1
    Affected ranges
    • ECOSYSTEM: < 12.6.0-1

    Update to 12.6.0-1

  • libvirt Ubuntu:Pro:14.04:LTS

    Versions
    • 1.1.1-0ubuntu8
    • 1.1.1-0ubuntu9
    • 1.1.4-0ubuntu2
    • 1.1.4-0ubuntu3
    • 1.1.4-0ubuntu4
    • 1.1.4-0ubuntu5
    • 1.2.0-0ubuntu1
    • 1.2.0-0ubuntu2
    • 1.2.0-0ubuntu3
    • 1.2.1-0ubuntu1
    • 1.2.1-0ubuntu2
    • 1.2.1-0ubuntu3
    • 1.2.1-0ubuntu4
    • 1.2.1-0ubuntu5
    • 1.2.1-0ubuntu7
    • 1.2.1-0ubuntu8
    • 1.2.1-0ubuntu9
    • 1.2.1-0ubuntu10
    • 1.2.2-0ubuntu1
    • 1.2.2-0ubuntu2
    • 1.2.2-0ubuntu3
    • 1.2.2-0ubuntu4
    • 1.2.2-0ubuntu5
    • 1.2.2-0ubuntu6
    • 1.2.2-0ubuntu7
    • 1.2.2-0ubuntu8
    • 1.2.2-0ubuntu9
    • 1.2.2-0ubuntu10
    • 1.2.2-0ubuntu11
    • 1.2.2-0ubuntu12
    • 1.2.2-0ubuntu13
    • 1.2.2-0ubuntu13.1
    • 1.2.2-0ubuntu13.1.1
    • 1.2.2-0ubuntu13.1.2
    • 1.2.2-0ubuntu13.1.4
    • 1.2.2-0ubuntu13.1.5
    • 1.2.2-0ubuntu13.1.6
    • 1.2.2-0ubuntu13.1.7
    • 1.2.2-0ubuntu13.1.8
    • 1.2.2-0ubuntu13.1.9
    • 1.2.2-0ubuntu13.1.10
    • 1.2.2-0ubuntu13.1.12
    • 1.2.2-0ubuntu13.1.14
    • 1.2.2-0ubuntu13.1.16
    • 1.2.2-0ubuntu13.1.17
    • 1.2.2-0ubuntu13.1.20
    • 1.2.2-0ubuntu13.1.21
    • 1.2.2-0ubuntu13.1.22
    • 1.2.2-0ubuntu13.1.23
    • 1.2.2-0ubuntu13.1.25
    • 1.2.2-0ubuntu13.1.26
    • 1.2.2-0ubuntu13.1.27
    • 1.2.2-0ubuntu13.1.28
    • 1.2.2-0ubuntu13.1.28+esm1
    • 1.2.2-0ubuntu13.1.28+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvirt Ubuntu:Pro:16.04:LTS

    Versions
    • 1.2.16-2ubuntu11
    • 1.2.16-2ubuntu12
    • 1.2.16-2ubuntu13
    • 1.2.16-2ubuntu14
    • 1.2.21-2ubuntu1
    • 1.2.21-2ubuntu3
    • 1.2.21-2ubuntu4
    • 1.2.21-2ubuntu5
    • 1.2.21-2ubuntu7
    • 1.2.21-2ubuntu8
    • 1.2.21-2ubuntu9
    • 1.2.21-2ubuntu10
    • 1.3.1-1ubuntu1
    • 1.3.1-1ubuntu2
    • 1.3.1-1ubuntu3
    • 1.3.1-1ubuntu4
    • 1.3.1-1ubuntu6
    • 1.3.1-1ubuntu9
    • 1.3.1-1ubuntu10
    • 1.3.1-1ubuntu10.1
    • 1.3.1-1ubuntu10.2
    • 1.3.1-1ubuntu10.3
    • 1.3.1-1ubuntu10.5
    • 1.3.1-1ubuntu10.6
    • 1.3.1-1ubuntu10.7
    • 1.3.1-1ubuntu10.8
    • 1.3.1-1ubuntu10.10
    • 1.3.1-1ubuntu10.11
    • 1.3.1-1ubuntu10.12
    • 1.3.1-1ubuntu10.13
    • 1.3.1-1ubuntu10.14
    • 1.3.1-1ubuntu10.15
    • 1.3.1-1ubuntu10.17
    • 1.3.1-1ubuntu10.18
    • 1.3.1-1ubuntu10.19
    • 1.3.1-1ubuntu10.21
    • 1.3.1-1ubuntu10.22
    • 1.3.1-1ubuntu10.23
    • 1.3.1-1ubuntu10.24
    • 1.3.1-1ubuntu10.25
    • 1.3.1-1ubuntu10.26
    • 1.3.1-1ubuntu10.27
    • 1.3.1-1ubuntu10.29
    • 1.3.1-1ubuntu10.30
    • 1.3.1-1ubuntu10.31
    Affected ranges
    • ECOSYSTEM: < 1.3.1-1ubuntu10.31+esm1

    Update to 1.3.1-1ubuntu10.31+esm1

  • libvirt Ubuntu:Pro:18.04:LTS

    Versions
    • 3.6.0-1ubuntu5
    • 3.6.0-1ubuntu6
    • 4.0.0-1ubuntu1
    • 4.0.0-1ubuntu2
    • 4.0.0-1ubuntu3
    • 4.0.0-1ubuntu4
    • 4.0.0-1ubuntu5
    • 4.0.0-1ubuntu6
    • 4.0.0-1ubuntu7
    • 4.0.0-1ubuntu8
    • 4.0.0-1ubuntu8.1
    • 4.0.0-1ubuntu8.2
    • 4.0.0-1ubuntu8.3
    • 4.0.0-1ubuntu8.4
    • 4.0.0-1ubuntu8.5
    • 4.0.0-1ubuntu8.6
    • 4.0.0-1ubuntu8.7
    • 4.0.0-1ubuntu8.8
    • 4.0.0-1ubuntu8.9
    • 4.0.0-1ubuntu8.10
    • 4.0.0-1ubuntu8.11
    • 4.0.0-1ubuntu8.12
    • 4.0.0-1ubuntu8.13
    • 4.0.0-1ubuntu8.14
    • 4.0.0-1ubuntu8.15
    • 4.0.0-1ubuntu8.16
    • 4.0.0-1ubuntu8.17
    • 4.0.0-1ubuntu8.19
    • 4.0.0-1ubuntu8.20
    • 4.0.0-1ubuntu8.21
    Affected ranges
    • ECOSYSTEM: < 4.0.0-1ubuntu8.21+esm1

    Update to 4.0.0-1ubuntu8.21+esm1

  • libvirt Ubuntu:Pro:20.04:LTS

    Versions
    • 5.4.0-0ubuntu5
    • 6.0.0-0ubuntu1
    • 6.0.0-0ubuntu2
    • 6.0.0-0ubuntu3
    • 6.0.0-0ubuntu4
    • 6.0.0-0ubuntu5
    • 6.0.0-0ubuntu6
    • 6.0.0-0ubuntu7
    • 6.0.0-0ubuntu8
    • 6.0.0-0ubuntu8.1
    • 6.0.0-0ubuntu8.2
    • 6.0.0-0ubuntu8.3
    • 6.0.0-0ubuntu8.4
    • 6.0.0-0ubuntu8.5
    • 6.0.0-0ubuntu8.7
    • 6.0.0-0ubuntu8.8
    • 6.0.0-0ubuntu8.9
    • 6.0.0-0ubuntu8.10
    • 6.0.0-0ubuntu8.11
    • 6.0.0-0ubuntu8.12
    • 6.0.0-0ubuntu8.13
    • 6.0.0-0ubuntu8.14
    • 6.0.0-0ubuntu8.15
    • 6.0.0-0ubuntu8.16
    • 6.0.0-0ubuntu8.19
    • 6.0.0-0ubuntu8.20
    Affected ranges
    • ECOSYSTEM: < 6.0.0-0ubuntu8.20+esm1

    Update to 6.0.0-0ubuntu8.20+esm1

  • libvirt Ubuntu:22.04:LTS

    Versions
    • 7.6.0-0ubuntu1
    • 7.6.0-0ubuntu3
    • 8.0.0-1ubuntu3
    • 8.0.0-1ubuntu4
    • 8.0.0-1ubuntu5
    • 8.0.0-1ubuntu6
    • 8.0.0-1ubuntu7
    • 8.0.0-1ubuntu7.1
    • 8.0.0-1ubuntu7.2
    • 8.0.0-1ubuntu7.3
    • 8.0.0-1ubuntu7.4
    • 8.0.0-1ubuntu7.5
    • 8.0.0-1ubuntu7.6
    • 8.0.0-1ubuntu7.7
    • 8.0.0-1ubuntu7.8
    • 8.0.0-1ubuntu7.9
    • 8.0.0-1ubuntu7.10
    • 8.0.0-1ubuntu7.11
    • 8.0.0-1ubuntu7.12
    • 8.0.0-1ubuntu7.13
    • 8.0.0-1ubuntu7.14
    • 8.0.0-1ubuntu7.15
    • 8.0.0-1ubuntu7.16
    • 8.0.0-1ubuntu7.17
    • 8.0.0-1ubuntu7.18
    Affected ranges
    • ECOSYSTEM: < 8.0.0-1ubuntu7.19

    Update to 8.0.0-1ubuntu7.19

  • libvirt Ubuntu:24.04:LTS

    Versions
    • 9.6.0-1ubuntu1
    • 9.6.0-1ubuntu2
    • 10.0.0-1ubuntu1
    • 10.0.0-2ubuntu1
    • 10.0.0-2ubuntu5
    • 10.0.0-2ubuntu7
    • 10.0.0-2ubuntu8
    • 10.0.0-2ubuntu8.1
    • 10.0.0-2ubuntu8.2
    • 10.0.0-2ubuntu8.3
    • 10.0.0-2ubuntu8.4
    • 10.0.0-2ubuntu8.5
    • 10.0.0-2ubuntu8.6
    • 10.0.0-2ubuntu8.7
    • 10.0.0-2ubuntu8.8
    • 10.0.0-2ubuntu8.9
    • 10.0.0-2ubuntu8.10
    • 10.0.0-2ubuntu8.11
    • 10.0.0-2ubuntu8.12
    • 10.0.0-2ubuntu8.13
    • 10.0.0-2ubuntu8.14
    • 10.0.0-2ubuntu8.15
    Affected ranges
    • ECOSYSTEM: < 10.0.0-2ubuntu8.16

    Update to 10.0.0-2ubuntu8.16

  • libvirt Ubuntu:26.04:LTS

    Versions
    • 11.6.0-1ubuntu3
    • 11.6.0-1ubuntu5
    • 11.6.0-1ubuntu6
    • 11.6.0-1ubuntu7
    • 11.6.0-1ubuntu8
    • 12.0.0-1ubuntu3
    • 12.0.0-1ubuntu5
    • 12.0.0-1ubuntu5.1
    • 12.0.0-1ubuntu5.2
    Affected ranges
    • ECOSYSTEM: < 12.0.0-1ubuntu5.3

    Update to 12.0.0-1ubuntu5.3

  • libvirt-hwe Ubuntu:26.04:LTS

    Versions
    • 12.0.0-1ubuntu5
    • 12.0.0-1ubuntu5.1
    • 12.0.0-1ubuntu5.2
    • 12.0.0-1ubuntu5.3
    Affected ranges
    • ECOSYSTEM: < 12.0.0-1ubuntu5.5

    Update to 12.0.0-1ubuntu5.5

Original sources

Check your server →