CVE-2026-93006Medium· 6.8▾ SunlitA flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a l…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.
rhceph/alloy-rhel10 (all versions)dnsmasq (all versions)dnsmasq (all versions)dnsmasq (all versions)dnsmasq (all versions)dnsmasq (all versions)openshift4/ose-baremetal-runtimecfg-rhel8 (all versions)openshift4/ose-baremetal-runtimecfg-rhel9 (all versions)openshift/ose-rhel-coreos-8 (all versions)openshift/ose-rhel-coreos-9 (all versions)openshift5/ose-baremetal-runtimecfg-rhel9 (all versions)openshift/ose-rhel-coreos-9 (all versions)dnsmasq (all versions)rhoso-operators/infra-rhel9-operator (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
The following measures reduce risk:
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-4693Medium· 5.5Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash
CVE-2026-93010Medium· 4.3Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
CVE-2026-93009Medium· 4.3Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
CVE-2026-93007Medium· 5.3Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
CVE-2026-93011Medium· 5.3Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
CVE-2026-93008Medium· 6.8Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations