Dnsmasq is vulnerable to an out‑of‑bounds write in DHCP BOOTREPLY processing. A crafted BOOTREPLY packet can overwrite adjacent memory, causing the dnsmasq daemon to crash. The crash produces a denial of service that can disrupt DNS and DHCP services for any client that contacts the compromised server. The flaw is classified as CWE‑787, a bounds checking failure, and the CVSS score of 7.5 indicates a high severity of impact.

The vulnerability affects Red Hat Enterprise Linux releases 6 through 10, as well as Red Hat OpenShift Container Platform 4, all of which ship a dnsmasq package that may be configured with the --dhcp-split-relay option. Vendors supplying the affected packages include Red Hat, the vendor for the impacted distributions and services.

The flaw can be triggered remotely by any user able to send a BOOTREPLY packet to the target dnsmasq instance. Because the exploit relies on network‑layer packet manipulation, an attacker with network access to the DHCP service can initiate the attack without requiring local privileges. The EPSS score is not available, but the high CVSS impact coupled with the remote nature of the exploit and absence from the KEV catalog means that organizations should treat this as a high‑risk denial‑of‑service vulnerability that is likely to be actively sought by threat actors, especially in environments where dnsmasq is used for DHCP relay or boot services.