CVE-2026-93007 Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation tha...

CVE-2026-93007

A flaw exists in dnsmasq where the TCP DNS service uses a small, fixed pool of child processes without setting a receive timeout on client connections. A remote attacker can exploit this by opening idle TCP connections to port 53 , occupying the entire process pool. This results in resource exhau...

CVE-2026-93011 Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small...

CVE-2026-93011

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small...

EUVD-2026-112789

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small...

CVE-2026-93011

A heap out-of-bounds write vulnerability exists in dnsmasq due to a reduction in internal domain-name buffer sizes. The DNSSEC validator can write a few bytes past a name buffer during name conversion to and from DNS wire format. An attacker capable of forcing the server to validate a crafted DNS...

CVE-2026-93011 Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small...

CVE-2026-93011

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small...

AlmaLinux 9.6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793303963)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793303963 advisory. - For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the...

PT-2026-132109

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small...

CVE-2026-93011: Red Hat: A flaw was found in dnsmasq

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small...

Linux Distros Unpatched Vulnerability : CVE-2026-93007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote...

Linux Distros Unpatched Vulnerability : CVE-2026-93011

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converti...

RHEL 10 : bind (RHSA-2026:90328)

"The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90328 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVE...

SSR-DNSSEC

The DNS infrastructure used for this PoC was the one suggested on the SEED Labs, available at: https://seedsecuritylabs.org/Labs20.04/Networking/DNS/DNSSEC/, with some minor changes. The infrastructure, consists of a root server, a top-level domain server for edu, a domain server for example.edu,...

MiracleLinux 9 : bind9.18-9.18.29-14.el9_8.11 (AXSA:2026-2193:07)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2193:07 advisory. bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses CVE-2026-19662 Tenable has extracted the preceding description block directly from the...

RLSA-2026:89745 Moderate: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

RLSA-2026:89746 Moderate: bind9.18 security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

bind security update

An update is available for bind. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Berkeley Internet Name Domain BIND is an implementation of the Domain Name...

bind9.18 security update

An update is available for bind9.18. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Na...