---
id: CVE-2026-93006
title: >-
  Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong
  file content
summary: >-
  A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents
  because a recently used transfer cache is not invalidated when a transfer
  finishes. An attacker on the local network who can request a TFTP file may
  cause a l…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-672
vendor: Red Hat
product: rhceph/alloy-rhel10
affected:
  - rhceph/alloy-rhel10 (all versions)
  - dnsmasq (all versions)
  - dnsmasq (all versions)
  - dnsmasq (all versions)
  - dnsmasq (all versions)
  - dnsmasq (all versions)
  - openshift4/ose-baremetal-runtimecfg-rhel8 (all versions)
  - openshift4/ose-baremetal-runtimecfg-rhel9 (all versions)
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
  - openshift5/ose-baremetal-runtimecfg-rhel9 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
  - dnsmasq (all versions)
  - rhoso-operators/infra-rhel9-operator (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T20:54:51.133440Z'
published: '2026-10-29'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T01:50:32.484Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-93006'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93006'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536075'
    label: RHBZ#2536075
tags:
  - cve.org
epss: 0.00302
epssPercentile: 0.2309
ingestedAt: '2026-11-05T19:30:42.848Z'
---

## Overview

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

## Affected

- `rhceph/alloy-rhel10 (all versions)`
- `dnsmasq (all versions)`
- `dnsmasq (all versions)`
- `dnsmasq (all versions)`
- `dnsmasq (all versions)`
- `dnsmasq (all versions)`
- `openshift4/ose-baremetal-runtimecfg-rhel8 (all versions)`
- `openshift4/ose-baremetal-runtimecfg-rhel9 (all versions)`
- `openshift/ose-rhel-coreos-8 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`
- `openshift5/ose-baremetal-runtimecfg-rhel9 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`
- `dnsmasq (all versions)`
- `rhoso-operators/infra-rhel9-operator (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

The following measures reduce risk:

1. If TFTP is not required, do not enable it. Remove --enable-tftp from the dnsmasq configuration.
2. If TFTP is required, restrict it with --tftp-interface=<interface> and avoid running TFTP-only instances that serve untrusted clients on the same network.
3. Compile without TFTP support using COPTS=-DNO_TFTP if TFTP is not needed.