6.8
MediumCVSS 3.1 · from redhat
CVE-2026-93006
Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content
rhceph/alloy-rhel10 · CWE-672 · CWE-672Affectedrhceph/alloy-rhel10, dnsmasq, dnsmasq and 11 more
FixNo fix listed yet.
PublishedOct 29, 12:47 · redhat
ScoredOct 29 · 6.8 · redhat
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read data and change data. CVSS impact.
Description
A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.
From redhat
Affected and fixed versions
ProductAffectedFixed inrhceph/alloy-rhel10all versions–dnsmasqall versions–dnsmasqall versions–dnsmasqall versions–dnsmasqall versions–dnsmasqall versions–openshift4/ose-baremetal-runtimecfg-rhel8all versions–openshift4/ose-baremetal-runtimecfg-rhel9all versions–openshift/ose-rhel-coreos-8all versions–openshift/ose-rhel-coreos-9all versions–openshift5/ose-baremetal-runtimecfg-rhel9all versions–openshift/ose-rhel-coreos-9all versions–dnsmasqall versions–rhoso-operators/infra-rhel9-operatorall versions–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known