CVE-2026-4893

Executive Summary

CVE-2026-4893 is an information disclosure vulnerability in dnsmasq, a widely deployed lightweight DNS forwarder and DHCP server. The flaw allows remote attackers to bypass source checks by crafting DNS packets that include RFC 7871 (EDNS Client Subnet, ECS) information. Successful exploitation permits an attacker to poison cache entries or extract resolver behavior details that should be restricted by source-based access controls. Patch confidence is rated 4/4 (CONFIRMED) with independent verification from the CNA, OSV, Debian, and RHSA sources, though no vendor fix version is explicitly documented in the provided dataset. The vulnerability carries a CVSS base score of 5.3 and has no known public exploit code or CISA KEV listing.

Technical Analysis

The vulnerability resides in dnsmasq's handling of DNS messages containing EDNS Client Subnet (ECS) options as defined in RFC 7871. ECS is a mechanism that allows a recursive resolver to convey the originating client's subnet to an authoritative name server, enabling geographically optimized DNS responses. The flaw lies in dnsmasq's failure to correctly enforce source-based validation checks when processing queries that include this extension.

The attack mechanism exploits a logical flaw in the source-checking logic: when a crafted DNS packet carries RFC 7871 client subnet information, dnsmasq's validation routine can be bypassed. This permits a remote, unauthenticated attacker to submit queries or responses that would normally be rejected based on the source address or authorized network configuration. The NVD description is sparse and does not provide specific function names, code paths, or configuration directives affected. The vulnerability class is best characterized as an access-control bypass leading to information disclosure — the attacker gains the ability to retrieve data that source checks are designed to protect.

From a protocol perspective, the EDNS0 OPT pseudo-record with the Client Subnet option (Option Code 8) is processed by dnsmasq during query parsing. The bug likely involves incorrect state handling when the ECS option modifies the query's perceived origin. The "Unknown" vendor product designation and empty affected-version list in the provided data preclude a precise version-level impact statement; insufficient technical detail is available to identify the exact patched commit, though four independent advisory sources confirm a fix exists.

Attack surface: dnsmasq listens on UDP/TCP port 53 by default. Any network with dnsmasq deployed as a forwarder, cache, or authoritative server from which it is reachable is exposed. The flaw does not require authentication or prior access, making it remotely exploitable. The CVSS score of 5.3 indicates medium severity; the vector string is not provided, so subscores cannot be enumerated precisely.

Exploitation Scenarios

No public PoC is available, and the attack chain is inferred from the vulnerability class and NVD description. The following steps outline the likely exploitation flow:

1. Reconnaissance / Target Identification: An attacker identifies a dnsmasq instance through network scanning for open UDP/53 or TCP/53 ports. Banner grabbing via a version query (e.g., dig chaos txt version.bind) or service fingerprinting confirms dnsmasq presence. Shodan queries such as product:dnsmasq can be used to locate exposed instances.

2. Triggering the Flaw: The attacker crafts a DNS query packet that includes an EDNS0 OPT pseudo-record carrying an RFC 7871 Client Subnet option. The ECS option contains a non-zero address family, source prefix length, and the attacker-controlled client subnet address. The crafted packet is designed to make dnsmasq's source-checking logic evaluate the packet as originating from a permitted subnet, even though the actual source IP is untrusted.

3. Payload / Execution Method: At the vulnerability-class level, this is an access-control bypass. The crafted ECS data manipulates dnsmasq's internal representation of the query's origin. The attacker sends the malicious DNS packet to the target. If the source checks are bypassed, the query is processed as if it came from an authorized source, enabling the attacker to request information that is restricted under normal conditions.

4. Post-Exploitation Impact: The information disclosure manifests when the attacker sends queries that trigger responses containing sensitive data — for example, internal DNS records, cache contents, or resolver behavior details that should only be served to authorized networks. If dnsmasq is configured to expose different views or filtered responses based on client subnet, the attacker can enumerate those discrepancies to map the internal network or extract information about the DNS resolution topology. In a cache-poisoning context, the bypass could enable an off-path attacker to inject records by correctly predicting transaction parameters. No public PoC exists; exploitation is theoretical and inferred, and no in-the-wild campaigns have been reported for this CVE.

Impact Assessment

The business impact of CVE-2026-4893 is moderate. The vulnerability is remotely exploitable without authentication and results in information disclosure, a breach of confidentiality. The CVSS base score of 5.3 places it at medium severity, typical for a partial confidentiality loss without integrity or availability impact. The EPSS percentile of 76.8% indicates that this vulnerability is in the upper quartile of exploit probability among known CVEs, albeit with an absolute probability of 0.01784% — meaning exploitation is plausible but not imminent.

Affected systems include any dnsmasq deployment used for DNS forwarding, caching, or DHCP services across enterprise networks, IoT deployments, home routers, and embedded systems. dnsmasq's prevalence in Linux-based consumer routers, firewall appliances (e.g., many open-source firewall distributions), and containerized environments expands the blast radius substantially. The blast radius in a typical enterprise: a compromised dnsmasq could expose internal DNS naming schemes, host information, and network segmentation details — reconnaissance enablers for lateral movement. However, the "affected versions" list is empty and OSV package data shows "/ (0→unfixed)", which complicates asset prioritization; security teams should treat all in-scope dnsmasq instances as potentially vulnerable until a patch version is confirmed from distribution advisories.

No integrity or availability impact is documented. The confidentiality impact is the sole concern. CISA KEV does not list this CVE, and no exploit code or Nuclei template exists, reducing immediate operational risk.

Detection Guidance

Sigma Rule

title: Dnsmasq ECS Bypass Attempt - Crafted EDNS Client Subnet Query
id: 3f8a7d2e-6c41-4b0f-9a2c-1e5d8b7a4f90
status: experimental
description: Detects DNS queries carrying RFC 7871 EDNS Client Subnet options sent to dnsmasq from unexpected sources, potentially indicating CVE-2026-4893 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4893
author: Valtersit Threat Intelligence
date: 2026/05/15
tags:
    - attack.t1190
    - attack.t1046
logsource:
    product: dns
    category: query
detection:
    selection_source:
        # Lan-facing interfaces where internal DNS servers receive queries
        dst.port: 53
    selection_ecs:
        # Flag ANY EDNS option as potential ECS marker; refine with vendor logs
        dns.type: "QUERY"
    condition: selection_source and selection_ecs
    timeframe: 1m
falsepositives:
    - Legitimate use of ECS by recursive resolvers (e.g., Google Public DNS, OpenDNS)
    - Internal clients with valid ECS forwarding policies
level: medium

YARA Rule

rule CVE_2026_4893_Dnsmasq_ECS_Bypass
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects crafted DNS packets with EDNS Client Subnet (RFC 7871) options targeting dnsmasq source checks"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-4893"
        severity = "medium"
    strings:
        // EDNS option code 8 (Client Subnet) in a DNS OPT pseudo-record
        // The pattern searches for the OPT record type (41) followed by option code 8
        $ecs_option = { 00 29 10 00 00 00 00 00 00 00 }
        $opt_type_41 = { 00 29 }
        // Common malformed ECS trigger patterns: address family + prefix lengths
        $af_inet_ecs = { 00 01 18 }
        $af_inet6_ecs = { 00 02 20 }
    condition:
        uint16(0) == 0 // DNS transaction ID present in payload
        and any of them
        and filesize < 65536
}

Suricata IDS Rule

alert udp any any -> any 53 (msg:"CVE-2026-4893 Dnsmasq ECS Source Check Bypass Attempt"; content:"|00 29|"; depth:13; offset:11; content:"|00 08|"; within:4; content:"|00 01|"; within:6; sid:20264893; rev:1; classtype:attempted-information-disclosure; reference:cve,2026-4893; metadata:created_at 2026-05-15, updated_at 2026-05-15;)

Elastic Detection

sequence by source.ip, destination.ip
  [ network where dns.question.type == "OPT" and dns.question.registered_domain == null ]
  [ network where dns.question.type == "OPT" and
      // Look for EDNS option code 8 (ECS) would appear here; adapt to your DNS log parser schema
      wildcard(dns.answers.name, "*.internal.*")
  ]

Splunk SPL Query

index=dns sourcetype=dns
| where dest_port=53 OR src_port=53
| regex _raw="\x00\x29\x10\x00\x00\x00\x00\x00\x00\x00" 
| eval ecs_present = if(match(_raw, "\x00\x29(?:.{4})\x00\x08"), "ECS Option Present", "No ECS")
| where ecs_present = "ECS Option Present"
| eval is_internal_query = if(match(query, "internal|\.local|\.corp|\.lan"), "Internal", "External")
| where is_internal_query = "Internal"
| table _time, src_ip, dest_ip, query, ecs_present
| sort - _time

Wazuh OSSEC Rule

<group name="dnsmasq,cve-2026-4893,dns,">
  <rule id="100893" level="8">
    <decoded_as>json</decoded_as>
    <field name="log_type">dnsmasq</field>
    <regex>EDNS.*Client Subnet|ECS|OPT pseudo-record</regex>
    <description>Dnsmasq query with RFC 7871 ECS information detected - potential CVE-2026-4893 source check bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dnsmasq,pci_dss_10.6.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is CONFIRMED at 4/4, verified through four independent sources: the CNA, OSV, Debian Security Advisories, and Red Hat Security Advisories (RHSA). While the upstream vendor fix version is not documented in the provided data (Vendor Fix: N/A), the confirmation from multiple Linux distribution security trackers (Debian and Red Hat) indicates that patched dnsmasq packages are available in their respective repositories.

1) Immediate Mitigations:

• Restrict network access to dnsmasq instances — apply firewall rules so that UDP/TCP port 53 is reachable only from trusted resolver clients and management networks.
• If dnsmasq serves as an internal resolver, block inbound DNS queries from WAN interfaces; ensure the service is not exposed to the internet unless strictly required.
• Monitor DNS logs for anomalous queries carrying EDNS Client Subnet options from unexpected source addresses; detection rules above can assist.
• Disable or minimize EDNS Client Subnet processing in dnsmasq configuration if the feature is not explicitly required; consult the dnsmasq man page for the relevant config directive.

2) Patch/Upgrade Steps:

• Debian-based systems: run sudo apt update && sudo apt upgrade dnsmasq, then verify the installed version against the Debian Security Advisory listed in references.
• Red Hat Enterprise Linux / Fedora / CentOS: use sudo yum update dnsmasq or sudo dnf update dnsmasq, checking the RHSA for the patched version.
• Other distributions or container images: consult the OSV database entry for dnsmasq to identify the fixed version; rebuild container images from updated base layers.
• For source builds: track the dnsmasq release announcements upstream and upgrade to the version that includes the ECS source-check fix.

3) Long-Term Hardening:

• Implement DNS over TLS (DoT) or DNS over HTTPS (DoH) in front of dnsmasq to add a transport-level security layer; consider a dedicated resolver (e.g., Unbound, Knot Resolver) for internet-facing recursion.
• Centralize DNS logging and feed it to a SIEM for continuous anomaly detection; correlate ECS-tagged queries with external source IPs.
• Segment DNS infrastructure into internal and external zones; dnsmasq on the internal zone should never process packets from rfc1918-unexpected sources.
• Monitor CISA KEV and EPSS scores to reassess prioritization; an EPSS percentile of 76.8% warrants review.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-4893 — National Vulnerability Database record for CVE-2026-4893, including the official NVD description and CVSS scoring.
2. OSV Database: https://osv.dev/vulnerability/CVE-2026-4893 — Open Source Vulnerability database entry with affected package status across distributions.
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-4893 — Debian advisory providing patch confirmation and fixed package versions.
4. Red Hat Security Advisory (RHSA): https://access.redhat.com/security/cve/CVE-2026-4893 — Red Hat advisory confirming the fix and listing affected Red Hat products.
5. RFC 7871: https://datatracker.ietf.org/doc/html/rfc7871 — Client Subnet in DNS Requests; the protocol extension implicated in the vulnerability mechanism.

No known threat actor campaigns or exploit-in-the-wild evidence exist for CVE-2026-4893 at the time of this report. CISA KEV does not list this CVE, and no PoC or Nuclei template is publicly available. The attack chain described above is inferred from the vulnerability class and NVD description; security teams should treat the flaw as a real but currently unobserved risk, prioritizing patch application based on the confirmed 4/4 patch confidence.