CVE-2026-4890

CVE-2026-4890

View on CVE.org
Published May 11, 2026 CVSS 3.1 · 7.5 High EPSS 8.8% KEV · Not listed
Description
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

Analysis

AI-generated

Technical impact

A flaw in dnsmasq’s DNSSEC validation logic—an uncontrolled resource consumption weakness identified as CWE-835—allows a remote attacker to send a specially crafted DNS packet that triggers the resolver to become unresponsive or crash. The result is a denial of service that impacts DNS resolution for clients connected to the affected server, without any known data confidentiality or integrity compromise. Based solely on the description, the attack requires the attacker to deliver packets to the dnsmasq instance over the network.

Affected Systems

The vulnerability affects dnsmasq installations that have DNSSEC validation enabled. No specific product versions are listed in the vendor data, so all releases that support DNSSEC validation are presumed vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, and an EPSS score of 9% indicates a higher exploitation probability in the wild. The vulnerability is not listed in CISA KEV, so public exploitation is uncertain but the impact on availability is significant for exposed servers.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update dnsmasq to the most recent stable release available from the vendor. If a patch addressing the DNSSEC validation flaw is released, apply it promptly.
  • If a patch cannot be applied immediately, disable DNSSEC validation on the dnsmasq instance to eliminate the infinite‑loop condition and stop the denial‑of‑service vector.
  • Apply network‑based rate limiting or packet size restrictions to reduce the risk of resource exhaustion from malformed DNS packets.
  • Monitor dnsmasq logs for traffic anomalies and activate fail‑over mechanisms to preserve DNS availability.

Generated by OpenCVE AI on October 25, 2026 at 19:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4625-1 dnsmasq security update
Debian DSA Debian DSA DSA-6264-1 dnsmasq security update
Ubuntu USN Ubuntu USN USN-8268-1 Dnsmasq vulnerabilities
History
Type Values Removed Values Added
Weaknesses CWE-400
Type Values Removed Values Added
Weaknesses CWE-835
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Weaknesses CWE-400
Type Values Removed Values Added
Weaknesses CWE-20
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Dnsmasq
Dnsmasq dnsmasq
Vendors & Products Dnsmasq
Dnsmasq dnsmasq
References
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-20
Type Values Removed Values Added
Description A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
Title CVE-2026-4890
References
Earlier changes (5)
Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')

Sources

Status
PUBLISHED
Assigner
certcc
Published
Updated
Sep 1, 2026, 12:05 PM
Reserved
Mar 26, 2026, 1:05 PM

View source JSON

Updated
Sep 1, 2026, 12:05 PM

JSON

Status
Awaiting Analysis
Published
May 11, 2026, 6:16 PM
Modified
Aug 25, 2026, 1:19 PM

View source JSON

Severity
Important
Public date
May 9, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Oct 25, 2026, 7:15 PM

JSON