CVE-2026-12969
published 2026-06-23CVE-2026-12969: An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.24%
15.1th percentile
An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| thekelleys | dnsmasq | < 2.93 | 2.93 |
| thekelleys | dnsmasq | — | — |
| ubuntu | dnsmasq | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_ubuntu5.9MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c.
ghsa_unreviewed·2026-06-23
CVE-2026-12969 [MEDIUM] CWE-125 An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c.
An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.
Ubuntu
Dnsmasq vulnerabilities
vendor_ubuntu·2026-07-14·CVSS 5.9
CVE-2026-12725 [MEDIUM] Dnsmasq vulnerabilities
Title: Dnsmasq vulnerabilities
Summary: Several security issues were fixed in Dnsmasq.
Yiwei Hou discovered that Dnsmasq incorrectly handled logging of DS or
DNSKEY. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-12725)
It was discovered that Dnsmasq incorrectly validated the length of
fixed-length DNS record fields when parsing NS section records. A remote
attacker could possibly use this issue to cause Dnsmasq to read out of
bounds, possibly exposing sensitive information. (CVE-2026-12969)
Instructions: After a standard system update you need to restart dnsmasq to make
all the necessary changes.
Red Hat
dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
vendor_redhat·2026-05-10·CVSS 5.3
CVE-2026-12969 [MEDIUM] CWE-125 dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.
Statement: Red Hat rates this issue as Low impact. While the vulnerability is remotely triggerable without authentication, the 10-byte out-of-bounds read stays within the over-allocated packet buffer in default dnsmasq configurations (1035 bytes of headroom be
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-12969 dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation [fedora-all]
bugzilla·2026-06-23·CVSS 5.3
CVE-2026-12969 [MEDIUM] CVE-2026-12969 dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation [fedora-all]
CVE-2026-12969 dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-12969 dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
bugzilla·2026-06-23·CVSS 5.3
CVE-2026-12969 [MEDIUM] CVE-2026-12969 dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
CVE-2026-12969 dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
An out-of-bounds read vulnerability was found in dnsmasq's find_soa() function in src/rfc1035.c. The function calls extract_name() with extrabytes=0 when parsing NS section records in NXDOMAIN/NODATA responses, which only validates that the DNS name fits within the packet but does not verify that 10 additional bytes exist for the fixed-length fields (type, class, TTL, rdlen). The subsequent GETSHORT/GETLONG macros then unconditionally read 10 bytes past the valid packet boundary.
An attacker controlling a DNS zone can trigger this by returning a crafted NXDOMAIN response where the NS record name (a compression pointer) extends to the packet boundary. The 10-byte over-read typically stay
2026-06-23
Published