A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade dnsmasq | May 15, 2026 | May 11, 2026 |
| Amazon Linux Ami 2 | — | Upgrade dnsmasqUpgrade dnsmasq-debuginfoUpgrade dnsmasq-utils | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade dnsmasqUpgrade dnsmasq-utils-debuginfoUpgrade dnsmasq-debugsourceUpgrade dnsmasq-debuginfoUpgrade dnsmasq-utils | May 28, 2026 | May 11, 2026 |
| Debian | — | Upgrade dnsmasq | May 12, 2026 | May 12, 2026 |
| Freebsd | — | Upgrade dnsmasqUpgrade dnsmasq-devel | May 13, 2026 | May 11, 2026 |
| Gentoo Linux | — | Upgrade net-dns/dnsmasq. | Aug 16, 2026 | Aug 13, 2026 |
| Redhat_linux | — | Upgrade dnsmasqUpgrade dnsmasq-debugsourceUpgrade dnsmasq-utilsUpgrade dnsmasq-debuginfoNo solution existsUpgrade dnsmasq-utils-debuginfo | May 20, 2026 | May 9, 2026 |
| Rocky_linux | — | Upgrade dnsmasq-debugsourceUpgrade dnsmasq-debuginfoUpgrade dnsmasq-utils-debuginfoUpgrade dnsmasq-utilsUpgrade dnsmasq | Jun 1, 2026 | May 29, 2026 |
| Suse | — | Upgrade dnsmasq-utilsUpgrade dnsmasq | May 26, 2026 | May 18, 2026 |
| Ubuntu | — | Upgrade dnsmasq (Ubuntu Pro)Upgrade dnsmasq | May 25, 2026 | May 12, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 29, 2026 | May 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub