CVE-2026-93008— Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

Quick assessment

Affected

Red Hat Red Hat Ceph Storage 9

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 dnsmasq 中发现一个漏洞。当 DNS 响应中包含 CNAME 记录并对其进行解析时，解析器可能会缓存 CNAME 目标对应的记录，而不会验证这些记录是否属于响应服务器所授权的区域。在采用分裂 DNS（split-DNS）架构的环境中，若部分域名被转发至特定的上游服务器，则控制该上游服务器的攻击者能够注入与目标无关的名称的缓存条目。此后，其他客户端在查询这些名称时，可能会收到由攻击者指定的 IP 地址。

CVSS 6.8 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1583 · Acquire Infrastructure T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对数据真实性的验证不充分

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Ceph Storage 9	-	`cpe:/a:redhat:ceph_storage:9`
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/o:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:enterprise_linux:6`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:enterprise_linux:7`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/o:redhat:enterprise_linux:9`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenStack Platform 13 (Queens)	-	`cpe:/a:redhat:openstack:13`
Red Hat	Red Hat OpenStack Platform 18.0	-	`cpe:/a:redhat:openstack:18.0`

II. Public POCs for CVE-2026-93008

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93008

请登录查看更多情报信息。

Other References for CVE-2026-93008 (2)

https://access.redhat.com/security/cve/CVE-2026-93008 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536079 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-93008

Same Patch Batch · Red Hat · 2026-10-29 · 16 CVEs total

CVE-2026-114488	7.4 HIGH	Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocation
CVE-2026-15564	7.4 HIGH	Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
CVE-2026-118425	6.8 MEDIUM	Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolut
CVE-2026-93006	6.8 MEDIUM	Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file conten
CVE-2026-117548	6.5 MEDIUM	389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schem
CVE-2026-19610	6.5 MEDIUM	Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for p
CVE-2026-117859	5.4 MEDIUM	Keycloak-services: keycloak-services: par single-use bypass via flow restart
CVE-2026-117627	5.4 MEDIUM	Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider l
CVE-2026-93007	5.3 MEDIUM	Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
CVE-2026-93011	5.3 MEDIUM	Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire trans
CVE-2026-117688	5.3 MEDIUM	Keycloak-services: keycloak-services: vault secret disclosure via client registration inst
CVE-2026-93009	4.3 MEDIUM	Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
CVE-2026-93010	4.3 MEDIUM	Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
CVE-2026-118030	4.2 MEDIUM	Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse acr
CVE-2026-85498	3.5 LOW	Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

IV. Related Vulnerabilities

Same product: Red Hat Ceph Storage 9

Same vendor: Red Hat

Same weakness: CWE-345