{"id":"CVE-2026-93006","title":"Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content","summary":"A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a l…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-672"],"vendor":"Red Hat","product":"rhceph/alloy-rhel10","affected":["rhceph/alloy-rhel10 (all versions)","dnsmasq (all versions)","dnsmasq (all versions)","dnsmasq (all versions)","dnsmasq (all versions)","dnsmasq (all versions)","openshift4/ose-baremetal-runtimecfg-rhel8 (all versions)","openshift4/ose-baremetal-runtimecfg-rhel9 (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift5/ose-baremetal-runtimecfg-rhel9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","dnsmasq (all versions)","rhoso-operators/infra-rhel9-operator (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-02T20:54:51.133440Z"},"published":"2026-10-29","updated":"2026-11-06","sourceUpdated":"2026-11-06T01:50:32.484Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93006","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93006"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536075","label":"RHBZ#2536075"}],"tags":["cve.org"],"epss":0.00302,"epssPercentile":0.2309,"ingestedAt":"2026-11-05T19:30:42.848Z","slug":"CVE-2026-93006","body":"## Overview\n\nA flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.\n\n## Affected\n\n- `rhceph/alloy-rhel10 (all versions)`\n- `dnsmasq (all versions)`\n- `dnsmasq (all versions)`\n- `dnsmasq (all versions)`\n- `dnsmasq (all versions)`\n- `dnsmasq (all versions)`\n- `openshift4/ose-baremetal-runtimecfg-rhel8 (all versions)`\n- `openshift4/ose-baremetal-runtimecfg-rhel9 (all versions)`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n- `openshift5/ose-baremetal-runtimecfg-rhel9 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n- `dnsmasq (all versions)`\n- `rhoso-operators/infra-rhel9-operator (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nThe following measures reduce risk:\n\n1. If TFTP is not required, do not enable it. Remove --enable-tftp from the dnsmasq configuration.\n2. If TFTP is required, restrict it with --tftp-interface=<interface> and avoid running TFTP-only instances that serve untrusted clients on the same network.\n3. Compile without TFTP support using COPTS=-DNO_TFTP if TFTP is not needed.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}