CVE-2026-4891

Executive Summary

CVE-2026-4891 is a heap-based out-of-bounds read vulnerability in the DNSSEC validation logic of dnsmasq, a widely deployed lightweight DNS forwarder and DHCP server. A remote, unauthenticated attacker can trigger the flaw by sending a specially crafted DNS packet to a target dnsmasq instance, causing a denial of service (process crash or memory disclosure). The vulnerability carries a CVSS 3.1 base score of 5.3 (Medium) with low confidentiality impact and no integrity/availability impact per the vector, though in practice the primary consequence is service disruption for any network relying on dnsmasq for DNS resolution. The existence of a confirmed fix is corroborated by multiple independent sources, but as of this writing no version string or vendor patch reference has been published, leaving affected deployments in a gap window.

Technical Analysis

The vulnerability resides in dnsmasq's DNSSEC validation code path. DNSSEC validation requires the resolver to parse and process RRSIG, DNSKEY, DS, and NSEC/NSEC3 record types, walking the chain of trust from a configured trust anchor to the requested record. The flaw is a classic heap-based out-of-bounds read (CWE-125): during parsing of a crafted DNS response or request that triggers DNSSEC validation, the code reads past the end of an allocated heap buffer.

Because the NVD description provides no named function, file, or line reference, exact code-level analysis is not possible. However, the class of bug is well understood. Heap out-of-bounds reads in DNS parsers commonly arise from:

• Incorrect length field validation — a DNS resource record header contains an RDLENGTH field; if the parser trusts this value without verifying it against the actual remaining bytes in the packet buffer, a short or malformed record causes the parser to read beyond the allocation.
• Integer truncation — 16-bit length fields being cast or used in arithmetic operations that truncate values, resulting in a read size larger than the intended buffer.
• Off-by-one errors in loop boundary checks when iterating over record sets (e.g., walking the RDATA section of an RRSIG record that contains a signature and signer name).

The attack surface is dnsmasq's listening UDP/TCP port 53 (DNS). The vulnerability is triggered by a crafted DNS packet; importantly, DNSSEC validation is only performed on responses received from upstream resolvers. This implies two plausible attack vectors:

1. Direct attack — If dnsmasq is configured with DNSSEC validation enabled (--dnssec) and exposed to untrusted networks, a malicious actor acting as a rogue upstream server could return a crafted DNS response to dnsmasq, triggering the out-of-bounds read in the validation logic.
2. Cache-poisoning-adjacent attack — A remote attacker could also attempt to exploit the resolver by sending responses that are accepted only if dnsmasq has forwarded the corresponding query. This requires either DNS spoofing capability or positioning on the network path.

The vulnerability is rated with a low confidentiality impact in the CVSS vector: the out-of-bounds read can cause the process to disclose a small amount of adjacent heap memory in the DNS response, but the practical impact is dominated by the abort/crash that results from the invalid memory access.

Exploitation Scenarios

Preconditions. The target must run an affected version of dnsmasq with DNSSEC validation enabled (--dnssec or equivalent configuration). The attacker needs network access to the dnsmasq instance — either directly to port 53 or the ability to inject spoofed DNS responses.

Step 1: Reconnaissance. The attacker identifies dnsmasq instances exposed on UDP port 53. Fingerprinting can be done by querying for DNS features (e.g., version.bind if enabled) or by sending malformed queries and observing differing error responses. Shodan dorks such as product:dnsmasq can expedite target discovery at scale.

Step 2: Trigger. The attacker crafts a DNS response packet containing a query that forces dnsmasq's DNSSEC validator to parse a resource record set. The malicious packet contains a record (such as an RRSIG or DNSKEY) whose declared length (RDLENGTH) exceeds the actual packet data, or whose structure causes the parser to read past the buffer boundary.

Step 3: Payload delivery. At the vulnerability-class level, the attacker sends this crafted DNS response either: (a) directly to the dnsmasq instance if it is configured to use the attacker's server as an upstream resolver, or (b) as spoofed traffic toward a dnsmasq instance that has an outstanding query for a domain under attacker control. The supplied response must appear valid enough to pass basic DNS message parsing and reach the DNSSEC validation stage.

Step 4: Impact. Upon parsing the malformed record, the out-of-bounds read leads to undefined behavior: either a segmentation fault (process crash) or, in a more contained case, a read of uninitialized heap memory that is then used in subsequent validation logic. A crash results in denial of service for all DNS clients relying on the affected dnsmasq server.

No public PoC is available; the attack chain is inferred from the vulnerability class. The description confirms a remote DoS, so the practical outcome is a crash or hang of the DNS service, with limited potential for non-sensitive memory disclosure in log output.

Impact Assessment

The immediate impact is denial of service: a single crafted packet can crash the dnsmasq process, taking down DNS resolution for every client and service that relies on it. In enterprise environments, dnsmasq commonly serves as the DNS forwarder for internal networks, DHCP-provided DNS for workstations, or as the resolver for container orchestration platforms (e.g., Kubernetes clusters using dnsmasq as a lightweight upstream). A crash here degrades name resolution across the blast radius, causing cascading failures in service discovery, application connectivity, and email routing.

The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — 5.3 Medium. While the confidentiality subscore (C:L) indicates possible limited memory disclosure, the functional impact on availability is what makes this threat operational. The low attack complexity and lack of authentication requirements mean that any network-reachable dnsmasq instance is exposed. The EPSS score of 0.06411 places this in the 93.2nd percentile of exploited CVEs, indicating materially elevated exploitation likelihood despite the absence of a public PoC at the time of writing.

No CISA KEV listing exists, and no known ransomware or APT campaigns have yet been tied to this CVE.

Detection Guidance

Detection of a heap out-of-bounds read in a DNS parser is challenging because the malicious traffic is protocol-compliant at the wire level until it reaches the vulnerable parsing logic. The following detections focus on behavioral anomalies: unusual DNS response structures, crashes, and abnormal validation activity.

Sigma Rule

title: Suspicious DNSSEC DNS Response with Oversized RDLENGTH
id: 6c1a2df1-9e2d-4d0a-bd83-d2a4d68b1f51
status: experimental
description: Detects DNS responses containing DNSSEC record types with RDLENGTH exceeding the remaining UDP payload, indicative of CVE-2026-4891 exploitation attempts.
logsource:
  category: dns
  product: dnsmasq
detection:
  selection:
    record_type:
      - 'RRSIG'
      - 'DNSKEY'
      - 'DS'
      - 'NSEC'
      - 'NSEC3'
    rdlength_bytes:  # signed integer > remaining packet length, requires query-level enrichment
      - 'large'
  condition: selection
falsepositives:
  - Legitimate fragmented DNS responses over TCP
  - Misconfigured upstream resolvers
level: medium

YARA Rule

rule CVE_2026_4891_dnsmasq_heap_oob_read
{
    meta:
        author = "Valter Security Research"
        description = "Detects DNS response packets with DNSSEC record types and implausible RDATA lengths suggestive of crafted payloads for CVE-2026-4891"
        date = "2026-01-01"
        cve = "CVE-2026-4891"
        severity = "medium"
    strings:
        $dnssec_rrsig = { 2e 00 }  // RRSIG type code (46)
        $dnssec_dnskey = { 30 00 }  // DNSKEY type code (48)
        $dnssec_ds    = { 2b 00 }  // DS type code (43)
        $dnssec_nsec  = { 2f 00 }  // NSEC type code (47)
        $dnssec_nsec3 = { 32 00 }  // NSEC3 type code (50)
    condition:
        uint16(0) == 0 or  // pcap/raw packet start; falls through to type check
        any of ($dnssec_*) and filesize > 200
}

Suricata IDS Rule

alert udp any any -> any 53 (msg:"CVE-2026-4891 Potential dnsmasq DNSSEC heap OOB read - anomalous RDLENGTH"; dns_query; content:"|00 2e 00 00|"; depth:4; offset:12; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:20264891; rev:1;)

Note on rule logic: A reliable in-rule calculation of RDLENGTH correlated with remaining payload length is non-trivial in Suricata. This rule flags a predefined threshold of inbound DNS queries containing dnssec record type code 46 (RRSIG) from the same source, which is a behavior associated with scanning for vulnerable resolvers.

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where dns.question.type == "RRSIG" or dns.question.type == "DNSKEY"]
  [process where event.action in ("crash", "segfault") and process.name == "dnsmasq"]

Splunk SPL Query

index=main sourcetype=dnsmasq
| search "DNSSEC" OR "validation failed" OR "dnsmasq:.*signal" 
| rex field=_raw "(?<signum>segmentation fault|SIGSEGV|abort)"
| stats count by host, signum, src_ip, dest_ip
| where signum="segmentation fault" OR signum="SIGSEGV" OR signum="abort"
| table _time, host, src_ip, dest_ip, signum, count

Wazuh OSSEC Rule

<group name="dnsmasq,">
  <rule id="20264891" level="10">
    <decoded_as>syslog</decoded_as>
    <field name="program_name">dnsmasq</field>
    <match>segmentation fault|SIGSEGV|signal</match>
    <description>CVE-2026-4891: dnsmasq process crash (possible heap out-of-bounds read in DNSSEC parsing)</description>
    <group>dnsmasq,local,pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status. Patch confidence is 4/4 (CONFIRMED). NVD, CNA, OSV, Debian, and Red Hat advisories independently corroborate the existence of a fix. However, the patch reference in the supplied data reads Vendor Fix: N/A and no specific upstream version is listed. This indicates that while sources confirm a fix exists, it has not yet propagated publicly as a named version string.

Immediate Mitigations (until patched):

1. Disable DNSSEC validation if it is not strictly required: remove --dnssec from the dnsmasq command line or set dnssec to false in the configuration. This removes the vulnerable code path entirely.
2. Restrict exposure of port 53/udp at the network boundary. If dnsmasq is intended only for internal use, apply firewall rules (iptables/nftables/cloud security groups) to block inbound DNS traffic from untrusted sources.
3. Configure dnsmasq to use only trusted upstream resolvers. Since the attack vector requires a malicious DNS response reaching the validator, ensuring upstreams are operator-controlled reduces the attack surface.
4. Monitor for abnormal process coredumps or restart loops.

Patch/Upgrade Steps:

1. Identify the installed dnsmasq version: dnsmasq --version.
2. Subscribe to vendor-distribution advisories (Debian Security Tracker, Red Hat RHSA) that reference CVE-2026-4891.
3. Apply the updated package as soon as it is released by your distribution vendor. For source builds, track the upstream dnsmasq repository for the commit addressing this CVE.
4. If a patch is not yet available in your package manager, consider backporting from the upstream commit once disclosed, or deploy a compiled-for-purpose version from a trusted security vendor build.

Long-Term Hardening:

1. Run dnsmasq as an unprivileged user in a chroot environment to limit the impact of a future code execution bug that could accompany such memory corruptions.
2. Enable core dump analysis (systemd-coredump, apport) to capture crash artifacts for forensic review.
3. Implement DNSSEC validation at a dedicated, well-maintained resolver (e.g., BIND or Unbound) rather than embedding it in lightweight forwarding tools, if the security posture demands it.
4. Deploy network-level intrusion detection (Suricata/Snort) to flag abnormal DNS record patterns as described in the detection section.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-4891
2. OSV.dev Entry (package: dnsmasq) — https://osv.dev/vulnerability/CVE-2026-4891
3. Red Hat Security Advisory (RHSA) — CVE-2026-4891 reference — https://access.redhat.com/security/cve/CVE-2026-4891
4. Debian Security Tracker — https://security-tracker.debian.org/tracker/CVE-2026-4891
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Entry: Not listed as of report date.)

No public exploit code, PoC, or weaponized tooling was identified at the time of writing. The elevated EPSS percentile suggests active reconnaissance or exploitation chatter in the wild; security teams should treat this as a priority patch candidate despite the absence of public exploit artifacts.