CVE-2026-93009
CVE-2026-93009 · Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
CVSS 4.3 · Medium · EPSS 0.2%
- Published
- Updated
Stack: system
Affected products and versions
red hat ceph storage 9
No fix published
red hat enterprise linux 10
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat enterprise linux 8
No fix published
red hat enterprise linux 9
No fix published
red hat openshift container platform 4
No fix published
red hat openshift container platform 5
No fix published
red hat openstack platform 13 (queens)
No fix published
red hat openstack platform 18.0
No fix published
dnsmasq Debian:12
- Versions
- 2.89-1
- 2.90-1
- 2.90-2
- 2.90-3
- 2.90-4
- 2.90-4~deb12u1
- 2.90-4~deb12u2
- 2.90-5
- 2.90-6
- 2.90-7
- 2.91-1
- 2.91~test6-1
- 2.91~test9-1
- 2.92-1
- 2.92-1+exp1
- 2.92-1~exp1
- 2.92-2
- 2.92-3
- 2.92-4
- 2.92-5
- 2.92~rc1-1
- 2.92~rc3-1
- 2.93-1
- 2.93-2
- 2.93-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsmasq Debian:13
- Versions
- 2.91-1
- 2.91-1+deb13u1
- 2.91-1+deb13u2
- 2.92-1
- 2.92-1+exp1
- 2.92-1~exp1
- 2.92-2
- 2.92-3
- 2.92-4
- 2.92-5
- 2.92~rc1-1
- 2.92~rc3-1
- 2.93-1
- 2.93-2
- 2.93-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsmasq Debian:14
- Versions
- 2.91-1
- 2.92-1
- 2.92-1+exp1
- 2.92-1~exp1
- 2.92-2
- 2.92-3
- 2.92-4
- 2.92-5
- 2.92~rc1-1
- 2.92~rc3-1
- 2.93-1
- 2.93-2
- 2.93-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published