CVE-2026-93011

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

This vulnerability is rated as Moderate because the overwrite is bounded to 1-3 bytes on a never-freed startup heap chunk, with no demonstrated crash or control-flow impact (availability None rather than Low). Both a compile-time HAVE_DNSSEC gate (off by default) and runtime --dnssec/--trust-anchor flags are required. This is a follow-on issue after the CVE-2026-2291 buffer reduction, not CVE-2026-2291 itself. Current Red Hat dnsmasq packages ship 2.90 or earlier and do not contain the 504-byte buffers introduced in v2.93.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The following measures reduce risk:

1. Do not enable --dnssec or --trust-anchor unless DNSSEC validation is required.
2. Omit -DHAVE_DNSSEC from COPTS (this is the default build).
3. If DNSSEC validation is required, restrict dnsmasq to trusted upstream resolvers.