CVE-2026-93009— Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

Quick assessment

Affected

Red Hat Red Hat Ceph Storage 9

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 dnsmasq 中发现了一个安全漏洞。其 DHCPv6 客户端主机名解析器在检查下一个标签长度之前，未先验证指针是否仍处于完全限定域名（FQDN）选项的范围内，导致可能读取超出该选项末尾的一个字节。本地网络中的攻击者仅通过发送一个精心构造的 DHCPv6 数据包即可触发此问题。该额外字节既不会返回给客户端，也不会被记录，目前尚未观察到因此导致程序崩溃的情况。

CVSS 4.3 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1133 · External Remote Services T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Ceph Storage 9	-	`cpe:/a:redhat:ceph_storage:9`
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/o:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:enterprise_linux:6`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:enterprise_linux:7`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/o:redhat:enterprise_linux:9`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenStack Platform 13 (Queens)	-	`cpe:/a:redhat:openstack:13`
Red Hat	Red Hat OpenStack Platform 18.0	-	`cpe:/a:redhat:openstack:18.0`

II. Public POCs for CVE-2026-93009

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93009

请登录查看更多情报信息。

Other References for CVE-2026-93009 (2)

https://access.redhat.com/security/cve/CVE-2026-93009 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536083 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-93009

Same Patch Batch · Red Hat · 2026-10-29 · 16 CVEs total

CVE-2026-114488	7.4 HIGH	Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocation
CVE-2026-15564	7.4 HIGH	Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
CVE-2026-118425	6.8 MEDIUM	Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolut
CVE-2026-93006	6.8 MEDIUM	Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file conten
CVE-2026-93008	6.8 MEDIUM	Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns config
CVE-2026-117548	6.5 MEDIUM	389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schem
CVE-2026-19610	6.5 MEDIUM	Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for p
CVE-2026-117859	5.4 MEDIUM	Keycloak-services: keycloak-services: par single-use bypass via flow restart
CVE-2026-117627	5.4 MEDIUM	Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider l
CVE-2026-93007	5.3 MEDIUM	Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
CVE-2026-93011	5.3 MEDIUM	Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire trans
CVE-2026-117688	5.3 MEDIUM	Keycloak-services: keycloak-services: vault secret disclosure via client registration inst
CVE-2026-93010	4.3 MEDIUM	Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
CVE-2026-118030	4.2 MEDIUM	Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse acr
CVE-2026-85498	3.5 LOW	Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

IV. Related Vulnerabilities

Same product: Red Hat Ceph Storage 9

Same vendor: Red Hat

Same weakness: CWE-125