Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-93008 3 Dnsmasq, Red Hat, Redhat 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more 2026-10-31 6.8 Medium
A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.
CVE-2026-93011 3 Dnsmasq, Red Hat, Redhat 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more 2026-10-31 5.3 Medium
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
CVE-2026-93007 3 Dnsmasq, Red Hat, Redhat 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more 2026-10-31 5.3 Medium
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
CVE-2026-93006 3 Dnsmasq, Red Hat, Redhat 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more 2026-10-31 6.8 Medium
A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.
CVE-2026-93010 3 Dnsmasq, Red Hat, Redhat 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more 2026-10-31 4.3 Medium
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.
CVE-2026-93009 3 Dnsmasq, Red Hat, Redhat 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more 2026-10-31 4.3 Medium
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
CVE-2026-12725 3 Dnsmasq, Redhat, Thekelleys 5 Dnsmasq, Enterprise Linux, Openshift and 2 more 2026-06-24 5.9 Medium
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.
CVE-2026-12969 3 Dnsmasq, Redhat, Thekelleys 5 Dnsmasq, Enterprise Linux, Openshift and 2 more 2026-06-24 5.3 Medium
An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.
CVE-2026-5172 1 Dnsmasq 1 Dnsmasq 2026-05-13 7.3 High
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.
CVE-2026-2291 1 Dnsmasq 1 Dnsmasq 2026-05-13 7.3 High
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.
CVE-2026-4890 1 Dnsmasq 1 Dnsmasq 2026-05-13 7.5 High
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
CVE-2026-4893 1 Dnsmasq 1 Dnsmasq 2026-05-13 5.3 Medium
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.
CVE-2026-4892 1 Dnsmasq 1 Dnsmasq 2026-05-12 8.4 High
A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.
CVE-2026-4891 1 Dnsmasq 1 Dnsmasq 2026-05-12 5.3 Medium
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
CVE-2005-0876 1 Dnsmasq 1 Dnsmasq 2026-04-16 N/A
Off-by-one buffer overflow in Dnsmasq before 2.21 may allow attackers to execute arbitrary code via the DHCP lease file.
CVE-2006-2017 1 Dnsmasq 1 Dnsmasq 2026-04-16 N/A
Dnsmasq 2.29 allows remote attackers to cause a denial of service (application crash) via a DHCP client broadcast reply request.
CVE-2020-37127 1 Dnsmasq 1 Dnsmasq 2026-04-15 5.5 Medium
Dnsmasq-utils 2.79-1 contains a buffer overflow vulnerability in the dhcp_release utility that allows attackers to cause a denial of service by supplying excessive input. Attackers can trigger a core dump and terminate the dhcp_release process by sending a crafted input string longer than 16 characters.
CVE-2025-12200 1 Dnsmasq 1 Dnsmasq 2025-11-04 3.3 Low
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
CVE-2025-12199 1 Dnsmasq 1 Dnsmasq 2025-11-04 3.3 Low
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.
CVE-2025-12198 1 Dnsmasq 1 Dnsmasq 2025-11-04 7.8 High
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and intentional behavior within dnsmasq's documented design, rather than security vulnerabilities.