Dnsmasq contains a flaw in its dnssec.c library that causes an infinite loop during DNSSEC NSEC/NSEC3 type bitmap parsing. When a DNSSEC‑signed zone returns a specially crafted response, the loop never exits, causing the dnsmasq process to hang and effectively deny DNS resolution for all clients. The vulnerability is a classic case of uncontrolled resource consumption (CWE‑835) and results in a Denial of Service.

The affected products are Red Hat Enterprise Linux releases 6 to 10 and Red Hat OpenShift Container Platform 4. All versions that ship the vulnerable dnsmasq package are impacted. The vulnerability is present in dnsmasq itself, regardless of the operating distribution.

Because the loop is triggered by a single crafted DNS‑SEC response, the most probable attack vector is a remote attacker who can influence a DNSSEC‑signed zone, sending the attacker‑controlled response to the victim dnsmasq server. The attack can be performed over the network, and only requires that dnsmasq is configured to validate DNSSEC on the zone in question. The CVSS base score of 4.4 classifies the impact as moderate, but the exploitability is limited to such zone control. No public exploitation reference exists yet, and the vulnerability is not listed in the CISA KEV catalog; the EPSS score is unavailable. The primary risk is infrastructure downtime with no direct confidentiality or integrity impact.