A heap-based buffer overflow occurs in dnsmasq when DNSSEC validation and query logging are simultaneously enabled and an unsupported DS or DNSKEY reply is logged. The overflow writes past the end of an internal logging buffer, leading to a crash of the dnsmasq process. The resulting denial of service can disrupt DNS resolution for clients relying on the affected instance.

Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4, all of which use the vulnerable dnsmasq version. The exact vulnerable dnsmasq version is not specified in the advisory, so the affected dnsmasq version is unknown.

The CVSS score of 5.9 indicates moderate severity, though the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. An attacker must remotely supply a DNS response containing an unsupported algorithm or digest type, and the target must have DNSSEC validation and query logging enabled. If these conditions are met, the attacker can cause a service outage by triggering the overflow, but no privilege escalation or data exfiltration results.