PT-2026-39648 · Dnsmasq · Dnsmasq

Andrew Fasano + 4 · Published 2026-05-11 · Updated 2026-05-13 · CVE-2026-2291

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions dnsmasq (affected versions not specified)

Description The extract name() function can be abused to cause a heap buffer overflow, a condition where data exceeds the allocated memory buffer on the heap. This allows an attacker to inject false DNS cache entries, potentially redirecting DNS lookups to an attacker-controlled IP address or causing a Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-2291

Affected Products

Dnsmasq

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-2291 · Security Note
• https://github.com/NixOS/nixpkgs/pull/519082 · Note
• https://github.com/NixOS/nixpkgs/pull/519093 · Note
• https://github.com/pi-hole/FTL/releases/tag/v6.6.2 · Note
• https://reddit.com/r/SecOpsDaily/comments/1ta9kll/vu471747_dnsmasq_contains_several_vulnerabilities · Reddit Post
• https://kb.cert.org/vuls/id/471747 · Note
• https://reddit.com/r/pihole/comments/1tahtvm/ftl_v662_security_updates_for_dnsmasq · Reddit Post
• https://twitter.com/CVEnew/status/2053932426985156678 · Twitter Post
• https://twitter.com/threatcluster/status/2054169861715091750 · Twitter Post
• https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html · Note
• https://twitter.com/the_yellow_fall/status/2054381112533946435 · Twitter Post
• https://thekelleys.org.uk/dnsmasq/doc.html · Note
• https://suse.com/security/cve/CVE-2026-2291.html · Note
• https://thekelleys.org.uk/dnsmasq/CVE · Note