CVE-2026-4891

A heap out-of-bounds read vulnerability was discovered in dnsmasq's DNSSEC validation. When processing RRSIG records, dnsmasq calculates the signature length by subtracting the fixed field size from the record's declared data length. A crafted RRSIG record with a data length smaller than the fixed fields causes this calculation to underflow, potentially resulting in an out-of-bounds read and process crash.

Red Hat Product Security rates this flaw as Important because an unauthenticated remote attacker can crash the dnsmasq daemon, leading to a complete denial of service for network name resolution. In typical Red Hat Enterprise Linux environments, dnsmasq does not enable DNSSEC validation by default, which restricts exposure to deployments where DNSSEC has been explicitly configured. Impact is limited to service availability, with no compromise of data confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.