Input validation error in Dnsmasq - CVE-2026-4890

Vulnerability identifier: #VU131140

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-4890

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in NSEC bitmap parsing in dnssec.c when processing crafted DNSSEC NSEC or NSEC3 records. A remote attacker can send a specially crafted DNS response to cause a denial of service.

No valid DNSSEC signatures are needed because the issue is reachable before RRSIG validation.

Dnsmasq
Gentoo Linux
Debian Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Ubuntu
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
net-dns/dnsmasq
dnsmasq (Ubuntu package)
dnsmasq-utils
dnsmasq
dnsmasq (Red Hat package)
dnsmasq-debuginfo
dnsmasq-help
dnsmasq-debugsource
dnsmasq-langpack
dnsmasq-doc
dnsmasq (Debian package)

Install security update from vendor's website.

Dnsmasq - update to 2.92
net-dns/dnsmasq - update to 2.66
dnsmasq (Ubuntu package) - addressed in versions 2.68-1ubuntu0.2+esm5, 2.90-0ubuntu0.16.04.1+esm3, 2.90-0ubuntu0.18.04.1+esm3, 2.90-0ubuntu0.20.04.1+esm2, 2.90-0ubuntu0.22.04.3, 2.90-2ubuntu0.3, 2.91-1ubuntu0.2, 2.92-1ubuntu0.2
dnsmasq-utils - addressed in versions 2.79-36, 2.90-3
dnsmasq - addressed in versions 2.79-36, 2.90-3
dnsmasq (Red Hat package) - addressed in versions 2.79-36.el8_10, 2.85-17.el9_6.1, 2.85-18.el9_8.1
dnsmasq-debuginfo - addressed in versions 2.82-21, 2.86-15, 2.90-8, 2.90-9
dnsmasq-help - addressed in versions 2.82-21, 2.86-15, 2.90-8, 2.90-9
dnsmasq-debugsource - addressed in versions 2.82-21, 2.86-15, 2.90-8, 2.90-9
dnsmasq - addressed in versions 2.82-21, 2.86-15, 2.90-8, 2.90-9
dnsmasq-langpack - update to 2.90-3
dnsmasq-doc - update to 2.90-3
dnsmasq (Debian package) - addressed in versions 2.90-4~deb12u2, 2.91-1+deb13u1

• https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html
• https://thekelleys.org.uk/dnsmasq/CVE/CVE-2026-4890.dnsmasq-2.92.diff

• Multiple vulnerabilities in Dnsmasq
• Debian update for dnsmasq
• Ubuntu update for dnsmasq
• Red Hat Enterprise Linux 9 update for dnsmasq
• Anolis OS update for dnsmasq
• openEuler 22.03 LTS SP4 update for dnsmasq
• openEuler 20.03 LTS SP4 update for dnsmasq
• openEuler 24.03 LTS SP3 update for dnsmasq
• openEuler 24.03 LTS update for dnsmasq
• Red Hat Enterprise Linux 8 update for dnsmasq
• openEuler 24.03 LTS SP1 update for dnsmasq
• Anolis OS update for dnsmasq
• Red Hat Enterprise Linux 9 update for dnsmasq
• Gentoo update for Dnsmasq