CVE-2026-93009Medium· 4.3▾ SunlitA flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the l…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
rhceph/alloy-rhel10 (all versions)dnsmasq (all versions)dnsmasq (all versions)dnsmasq (all versions)dnsmasq (all versions)dnsmasq (all versions)openshift4/ose-baremetal-runtimecfg-rhel8 (all versions)openshift4/ose-baremetal-runtimecfg-rhel9 (all versions)openshift/ose-rhel-coreos-8 (all versions)openshift/ose-rhel-coreos-9 (all versions)openshift5/ose-baremetal-runtimecfg-rhel9 (all versions)openshift/ose-rhel-coreos-9 (all versions)dnsmasq (all versions)rhoso-operators/infra-rhel9-operator (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
The following measures reduce risk:
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93010Medium· 4.3Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
CVE-2026-93007Medium· 5.3Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
CVE-2026-93011Medium· 5.3Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
CVE-2026-85498Low· 3.5Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
CVE-2026-93008Medium· 6.8Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations
CVE-2026-115485Medium· 6.3Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio