A flaw in dnsmasq’s DNSSEC validation logic allows a remote attacker to send a specially crafted DNS packet that triggers the resolver to become unresponsive or crash. The result is a denial of service that impacts DNS resolution for clients connected to the affected server, without any known data confidentiality or integrity compromise. Based solely on the description, the attack requires the attacker to deliver packets to the dnsmasq instance over the network.

The vulnerability affects dnsmasq installations that have DNSSEC validation enabled. No specific product versions are listed in the vendor data, so all releases that support DNSSEC validation are presumed vulnerable until a patch is applied.

The CVSS score of 7.5 indicates high severity, and an EPSS score of 3% shows a moderate likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, so public exploitation is uncertain but the impact on availability is significant for exposed servers.