A flaw in dnsmasq’s DNSSEC validation processing allows an attacker to send a specially crafted DNS packet that triggers a crash or causes the resolver process to hang. The impact is a denial of service affecting DNS resolution for clients; the vulnerability does not provide a path to compromise data confidentiality or integrity, but it can disrupt network connectivity. Based on the description, it is inferred that the attacker must have the ability to send packets to the dnsmasq instance over the network.

dnsmasq is the affected product. No explicit version information has been released, so all dnsmasq releases that enable DNSSEC validation are considered vulnerable until a patch is applied.

The CVSS score of 7.5 indicates a high severity. The EPSS score is < 1%, indicating a very low but non-zero exploitation probability, and the vulnerability is not listed in CISA KEV, so the public exploitation probability is uncertain. Nevertheless, any dnsmasq server exposed with DNSSEC enabled presents a high availability risk, as remote attackers can flood the resolver with malicious packets to deplete resources or crash the service.