It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1729 advisory.

    A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker     who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing     all DNS resolution for its clients. (CVE-2026-13002)

    A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to     cause a denial of service via a crafted DNS packet. (CVE-2026-4890)

    A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers     to cause a denial of service via a crafted DNS packet. (CVE-2026-4891)

    A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local     attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet. (CVE-2026-4892)

    An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a     crafted DNS packet with RFC 7871 client subnet information. (CVE-2026-4893)

    A buffer overflow in dnsmasq's extract_addresses() function allows an attacker to trigger a heap out-of-     bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the     pointer past the record's end. (CVE-2026-5172)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : dnsmasq, dnsmasq-utils (ALAS2023-2026-1729)

high Nessus Plugin ID 316834

Version 1.4

Version 1.2

Version 1.1

Version 1.4 Aug 25, 2026, 10:44 AM CVE (set "CVE" coverage to "CVE-2026-13002,CVE-2026-4890,CVE-2026-4891,CVE-2026-4892,CVE-2026-4893,CVE-2026-5172") CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608251044
Version 1.2 May 29, 2026, 5:27 PM Plugin metadata Plugin Feed: 202605291727
Version 1.1 May 27, 2026, 7:09 AM New Plugin Feed: 202605270709