4.3
MediumCVSS 3.1 · from redhat
CVE-2026-93009
Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
rhceph/alloy-rhel10 · Out-of-bounds read · CWE-125Affectedrhceph/alloy-rhel10, dnsmasq, dnsmasq and 11 more
FixNo fix listed yet.
PublishedOct 29, 13:13 · redhat
ScoredOct 29 · 4.3 · redhat
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
Description
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
From redhat
Affected and fixed versions
ProductAffectedFixed inrhceph/alloy-rhel10all versions–dnsmasqall versions–dnsmasqall versions–dnsmasqall versions–dnsmasqall versions–dnsmasqall versions–openshift4/ose-baremetal-runtimecfg-rhel8all versions–openshift4/ose-baremetal-runtimecfg-rhel9all versions–openshift/ose-rhel-coreos-8all versions–openshift/ose-rhel-coreos-9all versions–openshift5/ose-baremetal-runtimecfg-rhel9all versions–openshift/ose-rhel-coreos-9all versions–dnsmasqall versions–rhoso-operators/infra-rhel9-operatorall versions–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known