A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the `--dhcp-split-relay` option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8308-1 advisory.

    It was discovered that Dnsmasq incorrectly handled BOOTREPLY packets when configured with the --dhcp-     split-relay option. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a     denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6384a3cf14 advisory.

    # Update to 2.92rel2

    ## 2.92 point release incorporating fixes for:

      - CVE-2026-2291
      - CVE-2026-4890
      - CVE-2026-4891
      - CVE-2026-4892
      - CVE-2026-4893
      - CVE-2026-5172

    https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1934-1 advisory.

    This update for dnsmasq fixes the following issues

    Security issues:

    - CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).
    - CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).
    - CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).
    - CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source     checks       (bsc#1265004).
    - CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).
    - CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service     (bsc#1262487).

    Non security issues:

    - Updated to security release 2.92rel2.
    - aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).
    - Drop rcFOO symlinks for CODE16 (jsc#PED-266).
    - libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ac5cceec13 advisory.

    # Update to 2.92rel2

    ## 2.92 point release incorporating fixes for:

      - CVE-2026-2291
      - CVE-2026-4890
      - CVE-2026-4891
      - CVE-2026-4892
      - CVE-2026-4893
      - CVE-2026-5172

    https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e58a6acf77 advisory.

    Automatic update for dnsmasq-2.92rel2-9.fc45.

    ##### **Changelog**

    ```
    * Tue May 12 2026 Petr Menk <pemensik@redhat.com> - 2.92rel2-9
    - Update to 2.92rel2 (rhbz#2469245)
    * Mon Apr 20 2026 Petr Menk <pemensik@redhat.com> - 2.92-8
    - Fix 1 byte extra write byte in DHCP reply (rhbz#2459196)
    * Mon Feb 16 2026 Petr Menk <pemensik@redhat.com> - 2.92-7
    - Add optional build support for libasan
    * Wed Feb 11 2026 Petr Menk <<pemensik@redhat.com>> - 2.92-6
    - Do not fail hard on inotify socket or watch failure
    * Thu Jan 22 2026 Petr Menk <<pemensik@redhat.com>> - 2.92-5
    - Do not fail validation if signature owner name does not match (rbhz#2421820)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
317097	Ubuntu 26.04 LTS : Dnsmasq vulnerability (USN-8308-1)	Nessus	Ubuntu Local Security Checks	high
315523	Fedora 43 : dnsmasq (2026-6384a3cf14)	Nessus	Fedora Local Security Checks	high
315254	SUSE SLED15 / SLES15 Security Update : dnsmasq (SUSE-SU-2026:1934-1)	Nessus	SuSE Local Security Checks	high
314983	Fedora 44 : dnsmasq (2026-ac5cceec13)	Nessus	Fedora Local Security Checks	high
314305	Fedora 45 : dnsmasq (2026-e58a6acf77)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2026-6507

high

Tenable Plugins

high

high

high

high

high