A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-741:05 advisory.

    * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)
      * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)
      * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)
      * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)
      * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19373 advisory.

    * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)

    * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)

    * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)

    * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)

    * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:20589 advisory.

    * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)

    * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)

    * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)

    * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)

    * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3318 advisory.

    A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local     attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet. (CVE-2026-4892)

    An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a     crafted DNS packet with RFC 7871 client subnet information. (CVE-2026-4893)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of dnsmasq installed on the remote host is prior to 2.90-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DNSMASQ-2026-004 advisory.

    A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to     cause a denial of service via a crafted DNS packet. (CVE-2026-4890)

    A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers     to cause a denial of service via a crafted DNS packet. (CVE-2026-4891)

    A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local     attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet. (CVE-2026-4892)

    An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a     crafted DNS packet with RFC 7871 client subnet information. (CVE-2026-4893)

    A buffer overflow in dnsmasq's extract_addresses() function allows an attacker to trigger a heap out-of-     bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the     pointer past the record's end. (CVE-2026-5172)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20589 advisory.

    - Prevent overflow in extract_name function (CVE-2026-2291)
    - Prevent DoS in DNSSEC validation (CVE-2026-4890)
    - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
    - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:20589 advisory.

    * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)
      * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)
      * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)
      * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)
      * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1729 advisory.

    A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to     cause a denial of service via a crafted DNS packet. (CVE-2026-4890)

    A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers     to cause a denial of service via a crafted DNS packet. (CVE-2026-4891)

    A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local     attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet. (CVE-2026-4892)

    An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a     crafted DNS packet with RFC 7871 client subnet information. (CVE-2026-4893)

    A buffer overflow in dnsmasq's extract_addresses() function allows an attacker to trigger a heap out-of-     bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the     pointer past the record's end. (CVE-2026-5172)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:20589 advisory.

    The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic     Host Configuration Protocol) server.

    Security Fix(es):

    * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)

    * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)

    * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)

    * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)

    * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the dnsmasq package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19373 advisory.

    The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic     Host Configuration Protocol) server.

    Security Fix(es):

    * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)

    * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)

    * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)

    * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)

    * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6384a3cf14 advisory.

    # Update to 2.92rel2

    ## 2.92 point release incorporating fixes for:

      - CVE-2026-2291
      - CVE-2026-4890
      - CVE-2026-4891
      - CVE-2026-4892
      - CVE-2026-4893
      - CVE-2026-5172

    https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19158 advisory.

    The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic     Host Configuration Protocol) server.

    Security Fix(es):

    * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)

    * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)

    * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)

    * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)

    * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

    * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1934-1 advisory.

    This update for dnsmasq fixes the following issues

    Security issues:

    - CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).
    - CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).
    - CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).
    - CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source     checks       (bsc#1265004).
    - CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).
    - CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service     (bsc#1262487).

    Non security issues:

    - Updated to security release 2.92rel2.
    - aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).
    - Drop rcFOO symlinks for CODE16 (jsc#PED-266).
    - libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of dnsmasq installed on the remote host is prior to 2.92rel2. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-135-01 advisory.

    New dnsmasq packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the dnsmasq security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ac5cceec13 advisory.

    # Update to 2.92rel2

    ## 2.92 point release incorporating fixes for:

      - CVE-2026-2291
      - CVE-2026-4890
      - CVE-2026-4891
      - CVE-2026-4892
      - CVE-2026-4893
      - CVE-2026-5172

    https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the eeb4d69a-4d74-11f1-9a9c-994b98c88011 advisory.

    Simon Kelley reports:

            Today, 11th May 2026 CERT is releasing a set of six CVEs for serious             security vulnerabilities in dnsmasq. These are all long-standing             bugs             which apply to pretty much all non-ancient versions.


            Christopher Cullen and Molly Jaconski write, in Vulnerability Note             VU#471747:


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6264 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6264-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 11, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : dnsmasq     CVE ID         : CVE-2026-2291 CVE-2026-4890 CVE-2026-4891                      CVE-2026-4892 CVE-2026-4893 CVE-2026-5172

    Multiple security vulnerabilities have been discovered in Dnsmasq, a     lightweight DNS forwarder and DHCP server, which could result in cache     poisoning, bypass of security controls, denial of service or local     privilege escalation.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 2.90-4~deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 2.91-1+deb13u1.

    We recommend that you upgrade your dnsmasq packages.

    For the detailed security status of dnsmasq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dnsmasq

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local     attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet. (CVE-2026-4892)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318123	MiracleLinux 8 : dnsmasq-2.79-36.el8_10 (AXSA:2026-741:05)	Nessus	Miracle Linux Local Security Checks	high
317980	RockyLinux 9 : dnsmasq (RLSA-2026:19373)	Nessus	Rocky Linux Local Security Checks	high
317486	RockyLinux 8 : dnsmasq (RLSA-2026:20589)	Nessus	Rocky Linux Local Security Checks	high
317029	Amazon Linux 2 : dnsmasq, --advisory ALAS2-2026-3318 (ALAS-2026-3318)	Nessus	Amazon Linux Local Security Checks	high
316945	Amazon Linux 2 : dnsmasq, --advisory ALAS2DNSMASQ-2026-004 (ALASDNSMASQ-2026-004)	Nessus	Amazon Linux Local Security Checks	high
316920	Oracle Linux 8 : dnsmasq (ELSA-2026-20589)	Nessus	Oracle Linux Local Security Checks	high
316889	AlmaLinux 8 : dnsmasq (ALSA-2026:20589)	Nessus	Alma Linux Local Security Checks	high
316834	Amazon Linux 2023 : dnsmasq, dnsmasq-utils (ALAS2023-2026-1729)	Nessus	Amazon Linux Local Security Checks	high
316738	RHEL 8 : dnsmasq (RHSA-2026:20589)	Nessus	Red Hat Local Security Checks	high
316719	Photon OS 4.0: Dnsmasq PHSA-2026-4.0-1023	Nessus	PhotonOS Local Security Checks	high
315566	RHEL 9 : dnsmasq (RHSA-2026:19373)	Nessus	Red Hat Local Security Checks	high
315523	Fedora 43 : dnsmasq (2026-6384a3cf14)	Nessus	Fedora Local Security Checks	high
315378	RHEL 10 : dnsmasq (RHSA-2026:19158)	Nessus	Red Hat Local Security Checks	high
315254	SUSE SLED15 / SLES15 Security Update : dnsmasq (SUSE-SU-2026:1934-1)	Nessus	SuSE Local Security Checks	high
315015	Slackware Linux 15.0 / current dnsmasq Multiple Vulnerabilities (SSA:2026-135-01)	Nessus	Slackware Local Security Checks	high
314983	Fedora 44 : dnsmasq (2026-ac5cceec13)	Nessus	Fedora Local Security Checks	high
314369	FreeBSD : dnsmasq -- multiple vulnerabilities (eeb4d69a-4d74-11f1-9a9c-994b98c88011)	Nessus	FreeBSD Local Security Checks	high
314276	Debian dsa-6264 : dnsmasq - security update	Nessus	Debian Local Security Checks	high
314262	Linux Distros Unpatched Vulnerability : CVE-2026-4892	Nessus	Misc.	high

Detections

Analytics

CVE-2026-4892

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high