CVE-2026-93006— Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

Quick assessment

Affected

Red Hat Red Hat Ceph Storage 9

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 dnsmasq 中发现了一个漏洞。由于 TFTP 服务器在传输结束后未能使最近使用的传输缓存失效，导致其可能提供错误的文件内容。本地网络中的攻击者若能请求 TFTP 文件，则可能致使后续客户端接收到此前缓存的数据，而非其实际请求的文件。在 PXE 网络引导环境中，攻击者可利用此漏洞将受害者机器的引导内容替换为其自行指定的内容。

CVSS 6.8 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在过期或释放后对资源进行操作

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Ceph Storage 9	-	`cpe:/a:redhat:ceph_storage:9`
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/o:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:enterprise_linux:6`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:enterprise_linux:7`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/o:redhat:enterprise_linux:9`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenStack Platform 13 (Queens)	-	`cpe:/a:redhat:openstack:13`
Red Hat	Red Hat OpenStack Platform 18.0	-	`cpe:/a:redhat:openstack:18.0`

II. Public POCs for CVE-2026-93006

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93006

请登录查看更多情报信息。

Other References for CVE-2026-93006 (2)

https://access.redhat.com/security/cve/CVE-2026-93006 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536075 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-93006

Same Patch Batch · Red Hat · 2026-10-29 · 16 CVEs total

CVE-2026-114488	7.4 HIGH	Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocation
CVE-2026-15564	7.4 HIGH	Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
CVE-2026-118425	6.8 MEDIUM	Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolut
CVE-2026-93008	6.8 MEDIUM	Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns config
CVE-2026-117548	6.5 MEDIUM	389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schem
CVE-2026-19610	6.5 MEDIUM	Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for p
CVE-2026-117859	5.4 MEDIUM	Keycloak-services: keycloak-services: par single-use bypass via flow restart
CVE-2026-117627	5.4 MEDIUM	Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider l
CVE-2026-93007	5.3 MEDIUM	Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
CVE-2026-93011	5.3 MEDIUM	Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire trans
CVE-2026-117688	5.3 MEDIUM	Keycloak-services: keycloak-services: vault secret disclosure via client registration inst
CVE-2026-93009	4.3 MEDIUM	Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
CVE-2026-93010	4.3 MEDIUM	Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
CVE-2026-118030	4.2 MEDIUM	Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse acr
CVE-2026-85498	3.5 LOW	Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

IV. Related Vulnerabilities

Same product: Red Hat Ceph Storage 9

Same vendor: Red Hat

Same weakness: CWE-672