A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both
    enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause
    dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS
    response may crash the dnsmasq process, resulting in denial of service. (CVE-2026-12725)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784640629 advisory.

  - A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both     enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause     dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS     response may crash the dnsmasq process, resulting in denial of service. (CVE-2026-12725)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784645899 advisory.

  - A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both     enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause     dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS     response may crash the dnsmasq process, resulting in denial of service. (CVE-2026-12725)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784640629 advisory.

  - A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both     enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause     dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS     response may crash the dnsmasq process, resulting in denial of service. (CVE-2026-12725)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099495 advisory.

    A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and     query logging are both enabled, logging of DS or DNSKEY replies containing     unsupported algorithm or digest types can cause dnsmasq to write past the end     of an internal logging buffer. A remote attacker able to supply such a DNS     response may crash the dnsmasq process, resulting in denial of service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3028-1 advisory.

    This update for dnsmasq fixes the following issues

    - CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies     (bsc#1268764).
    - CVE-2026-12969: out-of-bounds read in `find_soa()` due to missing extrabytes validation (bsc#1268882).

    Changes for dnsmasq:

    - Update to 2.93:
     * Fix a corner-case in DNSSEC validation with wildcards.
     * Fix DNSSEC failure with spurious RRSIGs.
     * Fix DNSSEC fail with CNAME replies to DS queries.
     * Fix regression in 2.92 release which broke DHCPv6 when a DHCP      relay is in use.
     * Modify the inotify implementation so that inotify watches are      only created after dnsmasq has changed permissions and userid.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8542-1 advisory.

    Yiwei Hou discovered that Dnsmasq incorrectly handled logging of DS or DNSKEY. A remote attacker could     possibly use this issue to cause a denial of service. (CVE-2026-12725)

    It was discovered that Dnsmasq incorrectly validated the length of fixed-length DNS record fields when     parsing NS section records. A remote attacker could possibly use this issue to cause Dnsmasq to read out     of bounds, possibly exposing sensitive information. (CVE-2026-12969)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2974-1 advisory.

    This update for dnsmasq fixes the following issues

    - CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies     (bsc#1268764).
    - CVE-2026-12969: out-of-bounds read in `find_soa()` due to missing extrabytes validation (bsc#1268882).

    Changes for dnsmasq:

    - Update to 2.93:
     * Fix a corner-case in DNSSEC validation with wildcards.
     * Fix DNSSEC failure with spurious RRSIGs.
     * Fix DNSSEC fail with CNAME replies to DS queries.
     * Fix regression in 2.92 release which broke DHCPv6 when a DHCP      relay is in use.
     * Modify the inotify implementation so that inotify watches are      only created after dnsmasq has changed permissions and userid.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of dnsmasq installed on the remote host is prior to 2.93. It is, therefore, affected by a heap-based buffer overflow vulnerability. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21192-1 advisory.

    This update for dnsmasq fixes the following issues

    Update to 2.93:

    - CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies     (bsc#1268764).

    Changes for dnsmasq:

     * CVE-2026-12725, bsc#1268764: Heap buffer overflow in      `log_query()` when logging unsupported DS/DNSKEY replies.
     * Fix a corner-case in DNSSEC validation with wildcards.
     * Fix DNSSEC failure with spurious RRSIGs.
     * Fix DNSSEC fail with CNAME replies to DS queries.
     * Fix regression in 2.92 release which broke DHCPv6 when a DHCP      relay is in use.
     * Modify the inotify implementation so that inotify watches are      only created after dnsmasq has changed permissions and userid.
     * CVE-2026-2291: Rework storage allocation for domain names.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both     enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause     dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS     response may crash the dnsmasq process, resulting in denial of service. (CVE-2026-12725)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463269	Echo: dnsmasq: security update to 2.91-1+deb13u2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463269	Echo: dnsmasq: security update to 2.91-1+deb13u2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
361837	AlmaLinux 9.6 [TuxCare] Security Update: dnsmasq / dnsmasq-utils (ALMALINUX9.6:CLSA-2026:1784640629)	Nessus	Alma Linux Local Security Checks	Local	medium
361648	AlmaLinux 9.2 [TuxCare] Security Update: dnsmasq / dnsmasq-utils (ALMALINUX9.2:CLSA-2026:1784645899)	Nessus	Alma Linux Local Security Checks	Local	medium
361539	Rocky Linux 9.6 [TuxCare] Security Update: dnsmasq / dnsmasq-utils (ALMALINUX9.6:CLSA-2026:1784640629)	Nessus	Rocky Linux Local Security Checks	Local	medium
336097	Unity Linux 20.1070e Security Update: dnsmasq (UTSA-2026-099495)	Nessus	Unity Linux Local Security Checks	Local	medium
327286	SUSE SLED15 / SLES15 Security Update : dnsmasq (SUSE-SU-2026:3028-1)	Nessus	SuSE Local Security Checks	Local	medium
327063	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Dnsmasq vulnerabilities (USN-8542-1)	Nessus	Ubuntu Local Security Checks	Local	medium
326965	SUSE SLES12 Security Update : dnsmasq (SUSE-SU-2026:2974-1)	Nessus	SuSE Local Security Checks	Local	medium
325896	dnsmasq < 2.93 Heap-Based Buffer Overflow (CVE-2026-12725)	Nessus	DNS	Remote	medium
325045	openSUSE 16 Security Update : dnsmasq (openSUSE-SU-2026:21192-1)	Nessus	SuSE Local Security Checks	Local	high
321969	Linux Distros Unpatched Vulnerability : CVE-2026-12725	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-12725

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium