Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93011— Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

Quick assessment

Affected
Red Hat Red Hat Ceph Storage 9
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 dnsmasq 中发现了一个安全漏洞。在缩小内部域名缓冲区大小后，DNSSEC 验证器在将域名与 DNS 报文格式相互转换时，可能会向域名缓冲区之外写入少量字节。如果攻击者能够促使服务器验证一个特制的 DNSSEC 响应，则可能覆盖少量相邻的堆元数据。需要注意的是，DNSSEC 支持默认未编译进 dnsmasq，且必须在运行时显式启用。

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93011

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Ceph Storage 9 - cpe:/a:redhat:ceph_storage:9
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenStack Platform 13 (Queens) - cpe:/a:redhat:openstack:13
Red Hat Red Hat OpenStack Platform 18.0 - cpe:/a:redhat:openstack:18.0

II. Public POCs for CVE-2026-93011

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93011

请登录查看更多情报信息。

Other References for CVE-2026-93011 (2)

Same Patch Batch · Red Hat · 2026-10-29 · 16 CVEs total

CVE-2026-114488 7.4 HIGH Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocation
CVE-2026-15564 7.4 HIGH Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
CVE-2026-118425 6.8 MEDIUM Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolut
CVE-2026-93006 6.8 MEDIUM Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file conten
CVE-2026-93008 6.8 MEDIUM Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns config
CVE-2026-117548 6.5 MEDIUM 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schem
CVE-2026-19610 6.5 MEDIUM Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for p
CVE-2026-117859 5.4 MEDIUM Keycloak-services: keycloak-services: par single-use bypass via flow restart
CVE-2026-117627 5.4 MEDIUM Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider l
CVE-2026-93007 5.3 MEDIUM Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
CVE-2026-117688 5.3 MEDIUM Keycloak-services: keycloak-services: vault secret disclosure via client registration inst
CVE-2026-93009 4.3 MEDIUM Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
CVE-2026-93010 4.3 MEDIUM Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
CVE-2026-118030 4.2 MEDIUM Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse acr
CVE-2026-85498 3.5 LOW Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

IV. Related Vulnerabilities

Same product: Red Hat Ceph Storage 9
Same vendor: Red Hat
Same weakness: CWE-787