CVE-2026-4891
Received Received - Intake
Heap-based Out-of-Bounds Read in Dnsmasq DNSSEC Validation

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: CERT/CC

Description
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-11
Generated
2026-06-21
AI Q&A
2026-05-11
EPSS Evaluated
2026-06-19
NVD
CVE-2026-4891
EUVD
EUVD-2026-29153
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
the_dnsmasq_project dnsmasq *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate the vulnerability CVE-2026-4891 in dnsmasq, you should update dnsmasq to version 2.92rel2 or later, as this version addresses this and related vulnerabilities.

Applying the vendor-provided patches or updates promptly is recommended to prevent exploitation that could lead to denial of service or other attacks.

Executive Summary

This vulnerability is a heap-based out-of-bounds read in the DNSSEC validation component of dnsmasq. It allows remote attackers to send specially crafted DNS packets that cause the software to read memory outside the intended bounds, potentially leading to a denial of service.

Impact Analysis

The primary impact of this vulnerability is that an attacker can cause a denial of service (DoS) on systems running dnsmasq by sending malicious DNS packets. This can disrupt DNS resolution services, potentially affecting network availability and connectivity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4891. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart