CVE-2026-93007
CVE-2026-93007 · Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
CVSS 5.3 · Medium · EPSS 0.4%
- Published
- Updated
Stack: system
Affected products and versions
red hat ceph storage 9
No fix published
red hat enterprise linux 10
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat enterprise linux 8
No fix published
red hat enterprise linux 9
No fix published
red hat openshift container platform 4
No fix published
red hat openshift container platform 5
No fix published
red hat openstack platform 13 (queens)
No fix published
red hat openstack platform 18.0
No fix published
dnsmasq Debian:12
- Versions
- 2.89-1
- 2.90-1
- 2.90-2
- 2.90-3
- 2.90-4
- 2.90-4~deb12u1
- 2.90-4~deb12u2
- 2.90-5
- 2.90-6
- 2.90-7
- 2.91-1
- 2.91~test6-1
- 2.91~test9-1
- 2.92-1
- 2.92-1+exp1
- 2.92-1~exp1
- 2.92-2
- 2.92-3
- 2.92-4
- 2.92-5
- 2.92~rc1-1
- 2.92~rc3-1
- 2.93-1
- 2.93-2
- 2.93-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsmasq Debian:13
- Versions
- 2.91-1
- 2.91-1+deb13u1
- 2.91-1+deb13u2
- 2.92-1
- 2.92-1+exp1
- 2.92-1~exp1
- 2.92-2
- 2.92-3
- 2.92-4
- 2.92-5
- 2.92~rc1-1
- 2.92~rc3-1
- 2.93-1
- 2.93-2
- 2.93-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsmasq Debian:14
- Versions
- 2.91-1
- 2.92-1
- 2.92-1+exp1
- 2.92-1~exp1
- 2.92-2
- 2.92-3
- 2.92-4
- 2.92-5
- 2.92~rc1-1
- 2.92~rc3-1
- 2.93-1
- 2.93-2
- 2.93-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published