CVE-2026-2291

Executive Summary

CVE-2026-2291 is a heap buffer overflow vulnerability in the extract_name() function of dnsmasq, a widely deployed lightweight DNS, DHCP, and network boot server common on home routers, enterprise edge appliances, and embedded Linux devices. The flaw permits an unauthenticated remote attacker to trigger memory corruption through crafted DNS traffic, enabling two distinct attack outcomes: injection of false DNS cache entries that redirect victim lookups to attacker-controlled IP addresses (DNS cache poisoning), or a denial-of-service (DoS) condition via process crash. Affected organizations run dnsmasq on perimeter infrastructure, IoT gateways, and containerized network stacks. With public exploitation potential assessed at 7.3 CVSS severity and an official fix confirmed concurrently across CNA, OSV, Debian, and RHSA sources, immediate patching is recommended. No public exploit code, CISA KEV listing, or Nuclei template exists at reporting time.

Technical Analysis

The vulnerability resides in dnsmasq's extract_name() routine, an internal helper responsible for parsing DNS name fields within incoming query and response packets. DNS wire-format names are encoded as a sequence of length-prefixed labels (each label no longer than 63 bytes) terminated by a zero octet, with optional pointer compression (type 0xC0 followed by a 14-bit offset) to reference previously encountered name suffixes.

The function extract_name() performs iterative traversal of these label chains, validating lengths and following compression pointers. The heap overflow arises from an improper boundary validation when the function computes the total expanded name length across multiple labels — specifically during the accumulation or copy step into a fixed-size heap-allocated destination buffer. Insufficient checks on label length consistency and remaining destination capacity allow an attacker to craft a malformed name that forces out-of-bounds writes past the allocated heap chunk.

The heap layout discussed here (attacker-controlled long label chains adjacent to DNS cache entry objects) is the canonical attack scenario for this vulnerability class, where adjacent heap allocations can be corrupted to overwrite integrity metadata on cache objects.

From the NVD description, two exploitation pathways emerge:

1. False DNS cache injection: By corrupting adjacent heap metadata governing dnsmasq's cache entries, an attacker can write attacker-controlled data into cached resolution records. Subsequent victim queries for the poisoned names resolve to the IP address supplied by the attacker, enabling persistent traffic interception, credential harvesting, or payload delivery through the redirect target.

2. Denial of service: The same overflow condition can corrupt critical heap state (e.g., free-list pointers or allocation size metadata) causing an immediate crash on the next allocation or free operation, terminating the DNS service. Because dnsmasq frequently operates as the sole DNS resolver on embedded devices, losing it effectively disrupts all name resolution on that network segment.

The attack surface is the DNS listening socket (UDP port 53 by default), reachable by any host that can send packets to the device. No authentication is required for standard DNS queries. The specific input vector is a DNS query or response crafted with malformed name records that fail the extract_name() validation logic.

Exploitation Scenarios

No public PoC exists at the time of this writing; the attack chain below is inferred strictly from the vulnerability class and the NVD description. The description confirms the flaw is in extract_name(), is triggerable over the network, and impacts DNS cache integrity — not cache poisoning of the classic Kaminsky type, but rather a memory-corruption-induced injection.

Step 1 — Reconnaissance & Target Identification.

An attacker scans for hosts responding to DNS queries (UDP/53) using banner grabbing or simple dig queries to confirm the service is dnsmasq (identifiable by the lack of identifying banner in standard responses — dnsmasq does not identify itself in replies — so the attacker may fingerprint via behavior or by querying for DNS options). Targets include home routers (OpenWrt, DD-WRT), enterprise edge appliances, and containerized environments using dnsmasq as a lightweight resolver. The attacker maps the target IP range and confirms reachability of port 53.

Step 2 — Triggering the Flaw Class (Heap Buffer Overflow).

The attacker crafts a DNS message containing a name field engineered to include a sequence of labels whose total length, when processed by the extract_name() function, exceeds the allocation bounds of the destination heap buffer. The malformed name likely includes oversized label segments and/or multiple compression-pointer indirections designed to cause an inconsistent length calculation. This message is transmitted as either a crafted query (sent to the DNS port) or as a response that dnsmasq would cache (e.g., a recursive resolution response). The goal is to cause an out-of-bounds write during the name-decoding phase.

Step 3 — Payload/Execution Method.

At the vulnerability-class level, the payload is the malformed DNS name structure itself, which acts as both the corruption primitive and the carrier of injected data. For cache poisoning, the heap overflow writes attacker-controlled bytes over a nearby cache entry object, replacing the stored canonical name and resolved IP address with the attacker's chosen domain-to-IP mapping. For DoS, the overflow corrupts heap management metadata (size fields or forward/backward free-list pointers) so that the next free() or malloc() operation triggers a crash or arbitrary write.

Step 4 — Post-Exploitation Impact.

For the cache-injection path: the attacker inserts a malicious A/AAAA record mapping a legitimate domain (e.g., the target organization's update server) to an IP the attacker controls. When a victim on the trusted network requests that domain, dnsmasq returns the poisoned answer from cache. The victim connects to the attacker's server, believing it to be the legitimate destination. For the DoS path: the service crashes, dropping DNS resolution for all downstream clients, effectively severing network connectivity for applications reliant on name resolution.

Impact Assessment

CVSS Base Score: 7.3 (High).

The severity reflects a remotely exploitable memory-corruption flaw on a network service with no authentication barrier. The high confidentiality and integrity subscores implicitly reflect the false-cache-injection capability, as redirecting victim traffic undermines both data confidentiality and integrity at the application layer. Availability impact from the DoS variant is moderate (service restart recovery is typical).

Affected Systems.

Any device or operating environment embedding dnsmasq with a version prior to the official fix is vulnerable. This encompasses:

• Consumer and SOHO routers (OpenWrt, Tomato, DD-WRT distributions).
• Enterprise wireless controllers and access points that embed dnsmasq for DHCP/DNS.
• Linux containers using dnsmasq in Kubernetes kube-dns sidecar deployments or Docker embedded DNS.
• Virtualization platforms (e.g., Libvirt) that use dnsmasq for guest network name resolution.
• Automotive and IoT firmware images built on Buildroot or Yocto that include dnsmasq.
• Any system behind an outbound filtering proxy that exposes dnsmasq's UDP/53 directly to untrusted clients increases risk substantially.

Blast Radius.

For cache-poisoning exploitation, the blast radius extends to every client resolving through the affected dnsmasq instance. In enterprise deployments where dnsmasq serves as the internal forwarder, successful poisoning can redirect update checks, vendor-trusted domains, and internal service lookups — turning a single corrupted cache into broad lateral movement or persistent interception opportunities. On embedded/IoT devices, the same flaw forces the entire routing platform to restart or be manually reconfigured, whereas firewalls and user-space proxies often restore service automatically after the process crashes.

Detection Guidance

Detection of memory-corruption exploitation is necessarily heuristic. The following rules focus on anomalous DNS payload characteristics and abnormal cache-behavior patterns that would correlate with attempts to trigger the extract_name() heap overflow.

Sigma Rule

title: Suspicious Malformed DNS Query Targeting dnsmasq extract_name Overflow
status: experimental
description: Detects malformed DNS query names violating wire-format label lengths, possible CVE-2026-2291 exploitation attempt.
author: Valtersit Threat Intel
logsource:
    product: dnsmasq
    service: dns
detection:
    selection:
        # dnsmasq logs malformed packet events on debug but standard deployments often log nothing.
        # Use query pattern heuristics below on packet-capture logs.

Note: Due to the absence of standardized dnsmasq structured query logs across platforms, a more reliable Sigma rule targets network IDS alert output. The rule below consumes DNS-query metadata from Zeek/Suricata EVE that already parses packet fields:

title: dnsmasq Extreme Query Name Length
status: experimental
description: Detects single DNS query containing an inordinate total domain name expansion length, a trigger of heap overflow in extract_name.
logsource:
    category: dns-query
    product: zeek
detection:
    selection:
        query.length: "> 253"
        # The DNS wire format max name length is 255. Queries that arrive at the parsing layer
        # with >255 total expanded characters indicate a crafted malformed packet.
    condition: selection
falsepositives:
    - Application-level bugs producing long invalid queries
level: high

The rule above is realistic only where Zeek/DNS parsers expose raw decoded name lengths; most standard parsers truncate invalid names, producing no event — an absence-of-event condition is notable in that case.

YARA Rule

rule dnsmasq_extract_name_heapoverflow_pcap
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects pcap files containing crafted DNS names targeting dnsmasq extract_name heap overflow (CVE-2026-2291)"
        cve = "CVE-2026-2291"
        date = "2026-05-15"
        reference = "NVD CVE-2026-2291"
    strings:
        // DNS header: QR=0 (query), then QDCOUNT=1
        $dns_query_hdr = { 00 00 01 00 00 01 00 00 00 00 00 00 }
        // Large label length prefix (0x3F = 63 bytes max per RFC; value above 0x3F signals out-of-spec)
        $overlong_label_len = { 40 }   // 0x40 = 64, invalid label length
        $pointer_chain = { C0 0C }     // compression pointer to offset 12 (typical name start)
    condition:
        uint16(0) == 0x???? and $dns_query_hdr at 0 and #overlong_label_len > 1 and any of ($pointer_chain*)
}

Standard YARA lacks the ability to compute expanded-name-length arithmetic, so the rule above flags malformed label-length octets exceeding the 63-byte RFC boundary — a necessary precondition for triggering the extract_name() length-check fault.

Suricata IDS Rule

alert dns any any -> any 53 (msg:"ET EXPLOIT dnsmasq extract_name DNS Name Length Overflow Attempt (CVE-2026-2291)"; flow:to_server; dns_query; content:"|40|"; offset:12; depth:2; dns.query.length:>255; classtype:attempted-admin; sid:6000001; rev:1; reference:cve,2026-2291;)

This rule targets raw DNS over UDP, matching a query that contains an invalid label-length octet (0x40 +) within the query-name region and a name-expansion length exceeding 255 — the classic preconditions for memory-corruption attempts against name parsers. Adjust for DNS over TCP by adding an additional TCP rule variant; most dnsmasq deployments default UDP-only.

Elastic Detection

Elastic EQL can key off network-level metadata when DNS is parsed by the Packetbeat or Zeek integration:

// In an index containing Zeek dns.log events
sequence by source.ip
  [ network where dns.question.name != null
      and length(dns.question.name) > 253 ]
  [ process where process.name == "dnsmasq"
      and event.type == "end"
      and process.exit_code != 0 ]

The first event denotes an oversized, malformed DNS query from a single source; if dnsmasq subsequently terminates (process exit with a non-zero code) shortly thereafter, the correlation strongly suggests the query crashed the resolver. Run across a 5-minute search window against indices populated by ECS-mapped dns events.

Splunk SPL Query

index=network sourcetype=suricata signature="ET EXPLOIT dnsmasq extract_name DNS Name Length Overflow Attempt (CVE-2026-2291)"
  OR (index=network sourcetype=zeek_dns dns_query_length > 253)
| stats min(_time) as first_seen max(_time) as last_seen
        by src_ip, dest_ip, dest_port, dns_query
| where (last_seen - first_seen) < 300

Combines IDS signature hits with Zeek DNS query-length anomalies, retaining sessions that recur within five minutes — a sign of repeated technique attempts to brute-force heap layout craft.

Wazuh OSSEC Rule

<group name="dnsmasq,">
  <!-- Detect dnsmasq crash immediately after odd DNS traffic observed -->
  <rule id="100401" level="12">
    <if_sid>100000</if_sid> <!-- parent rule: process crash via SIGSEGV -->
    <field name="command">dnsmasq</field>
    <description>dnsmasq terminated abnormally - possible heap overflow exploitation (CVE-2026-2291)</description>
    <group>exploit_attempt,dns,memory_overflow</group>
  </rule>
</group>

The premise is that Wazuh consumes system logs (journald/syslog) where dnsmasq emits crash/segfault signals. The rule above escalates any abnormal termination event referencing the dnsmasq binary. Combine with the frequency of UDP/53 queries on the same host from a single remote source for increased fidelity, but product vendors rarely log raw packet levels to syslog — thus the operational signature merges crash detection and external query patterns in practice.

Mitigation & Patch Guidance

Patch Confidence: 4/4 (CONFIRMED) — independent confirmation by CNA, OSV, Debian, and RHSA.

1. Immediate mitigations (before patch deployment):
   • Restrict inbound and outbound DNS access to dnsmasq (UDP/TCP 53) using host-level firewall rules: allow only known internal resolver clients; block all external/ingress traffic to port 53 from the WAN interface.
   • Disable DNS recursion if the dnsmasq instance only serves local forward zones (set local-service in dnsmasq.conf where supported). Without recursion, remote external attackers cannot induce the cache to accept arbitrary responses — though direct malformed queries may still be processed; restrict via access-control lists (interface= directives binding dnsmasq only to internal interfaces).
   • Deploy rate-limiting on UDP/53 queries (e.g., dnsmasq --max-queries or external iptables rules) to slow brute-force attempts.
2. Patch/upgrade steps:
   • Pull the distro-patched version available from Debian, OSV, and RHSA advisory repositories. For Debian: apt-get update && apt-get upgrade dnsmasq. RHSA: yum update dnsmasq.
   • For embedded or custom-built dnsmasq: rebuild from the vendor’s patched source tree or the upstream commit that addressed the extract_name() flaw. Confirm the version contains the CVE fix prior to deployment.
   • Restart the dnsmasq service and verify resume of normal caching via kill -HUP $(pidof dnsmasq) or full service restart.
3. Long-term hardening:
   • Where possible, migrate from dnsmasq to a memory-safe resolver (e.g., Knot Resolver, Unbound) on internet-facing deployments; retain dnsmasq only for isolated internal/DHCP networks.
   • Apply vendor security updates at least monthly in CI-style pipelines that test the DNS resolver’s behavior.
   • Monitor CVE feeds and immediately queue any high-severity dnsmasq release — this is the third high-severity heap-corruption-class finding in dnsmasq since 2020, indicating a pattern warranting proactive version pinning and integration testing of old/new binaries in staging.

References

1. NVD Entry: CVE-2026-2291 — https://nvd.nist.gov/vuln/detail/CVE-2026-2291
2. OSV Advisory: CVE-2026-2291 — https://osv.dev/vulnerability/CVE-2026-2291
3. Debian Security Tracker — https://security-tracker.debian.org/tracker/CVE-2026-2291
4. Red Hat Security Advisory (RHSA) — Catalog entry referencing the dnsmasq patch for CVE-2026-2291.
5. CERT Coordination Center (CNA) advisory on the dnsmasq extract_name() heap overflow — coordinated disclosure notification.

As of this writing, no confirmed threat-actor campaign exploiting CVE-2026-2291 in the wild has been recorded, and CISA has not added this CVE to its Known Exploited Vulnerabilities (KEV) catalog. EPSS places it at 0.61% likelihood of active exploitation in the next 30 days (47th percentile among all CVEs), reflecting the limited public knowledge and absence of a readily available exploit path. Nevertheless, the confirmed remediation from four independent sources and the historical precedent of dnsmasq memory-safety bugs being weaponized shortly after disclosure warrant aggressive patch prioritization for internet-adjacent deployments. Monitor the referenced OSV and NVD pages for updates should the CNA release version-specific affected-range data, which was not available in the original advisory metadata.