CVE-2026-12725
published 2026-06-22CVE-2026-12725: A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.40%
32.7th percentile
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and
query logging are both enabled, logging of DS or DNSKEY replies containing
unsupported algorithm or digest types can cause dnsmasq to write past the end
of an internal logging buffer. A remote attacker able to supply such a DNS
response may crash the dnsmasq process, resulting in denial of service.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | 4.0 – 4.22.1 | — |
| thekelleys | dnsmasq | < 2.93 | 2.93 |
| thekelleys | dnsmasq | — | — |
| ubuntu | dnsmasq | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Dnsmasq vulnerabilities
vendor_ubuntu·2026-07-14·CVSS 5.9
CVE-2026-12725 [MEDIUM] Dnsmasq vulnerabilities
Title: Dnsmasq vulnerabilities
Summary: Several security issues were fixed in Dnsmasq.
Yiwei Hou discovered that Dnsmasq incorrectly handled logging of DS or
DNSKEY. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-12725)
It was discovered that Dnsmasq incorrectly validated the length of
fixed-length DNS record fields when parsing NS section records. A remote
attacker could possibly use this issue to cause Dnsmasq to read out of
bounds, possibly exposing sensitive information. (CVE-2026-12969)
Instructions: After a standard system update you need to restart dnsmasq to make
all the necessary changes.
Red Hat
dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies
vendor_redhat·2026-04-21·CVSS 5.9
CVE-2026-12725 [MEDIUM] CWE-122 dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies
dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and
query logging are both enabled, logging of DS or DNSKEY replies containing
unsupported algorithm or digest types can cause dnsmasq to write past the end
of an internal logging buffer. A remote attacker able to supply such a DNS
response may crash the dnsmasq process, resulting in denial of service.
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and
query logging are both enabled, logging of DS or DNSKEY replies containing
unsupported algorithm or digest types can cause dnsmasq to write past the end
of an internal logging buffer. A remote attacker able to supply such a DNS
response may cras
VulDB
Red Hat Enterprise Linux/OpenShift Container Platform heap-based overflow (EUVD-2026-38278 / Nessus ID 321969)
vuldb·2026-06-22·CVSS 5.9
CVE-2026-12725 [MEDIUM] Red Hat Enterprise Linux/OpenShift Container Platform heap-based overflow (EUVD-2026-38278 / Nessus ID 321969)
A vulnerability marked as critical has been reported in Red Hat Enterprise Linux and OpenShift Container Platform. This vulnerability affects unknown code. Performing a manipulation results in heap-based buffer overflow.
This vulnerability is known as CVE-2026-12725. Remote exploitation of the attack is possible. No exploit is available.
GHSA
A heap-based buffer overflow was found in dnsmasq.
ghsa_unreviewed·2026-06-22
CVE-2026-12725 [MEDIUM] CWE-122 A heap-based buffer overflow was found in dnsmasq.
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and
query logging are both enabled, logging of DS or DNSKEY replies containing
unsupported algorithm or digest types can cause dnsmasq to write past the end
of an internal logging buffer. A remote attacker able to supply such a DNS
response may crash the dnsmasq process, resulting in denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-12725 dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies [fedora-all]
bugzilla·2026-07-17·CVSS 5.9
CVE-2026-12725 [MEDIUM] CVE-2026-12725 dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies [fedora-all]
CVE-2026-12725 dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow exists in dnsmasq's log_query() function (src/cache.c).
When query logging is enabled and dnsmasq logs DS or DNSKEY replies containing
unsupported algorithm or digest types, the "(not supported)" suffix causes
sprintf() to write past the end of daemon->addrbuff, a 46-byte heap buffer.
Trigger example: a DS record with key_tag=65535, algorithm=255, digest_type=255
(both algorithm 255 and digest_type 255 are IANA-unassigned)
Bugzilla
CVE-2026-12725 dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies
bugzilla·2026-06-19·CVSS 5.9
CVE-2026-12725 [MEDIUM] CVE-2026-12725 dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies
CVE-2026-12725 dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies
A heap buffer overflow exists in dnsmasq's log_query() function (src/cache.c).
When query logging is enabled and dnsmasq logs DS or DNSKEY replies containing
unsupported algorithm or digest types, the "(not supported)" suffix causes
sprintf() to write past the end of daemon->addrbuff, a 46-byte heap buffer.
Trigger example: a DS record with key_tag=65535, algorithm=255, digest_type=255
(both algorithm 255 and digest_type 255 are IANA-unassigned), causing the
"(not supported)" branch in dnssec.c to fire during logging.
Prerequisites:
- DNSSEC validation enabled
- Query logging enabled (e.g. --log-queries)
Impact: bounded heap write overflow (~12 bytes). Upstream maintainer Simon
2026-06-22
Published