Debian Patches

Status for dnsmasq/2.91-1+deb13u2

Patch Description Author Forwarded Bugs Origin Last update
eliminate-privacy-breaches.patch Remove or replace privacy breaching logos and forms Lintian complains about these by issuing the tags privacy-breach-logo and
privacy-breach-donation.		 Sven Geuer <debmaint@g-e-u-e-r.de> not-needed 2023-11-18
trailing-white-space.patch Remove trailing white space For now only the file reported in bug #1022706 is handled by this patch while
upstream has been informed about all existing cases.		 Sven Geuer <sge@debian.org> yes debian 2024-11-23
CVE-2026-2291.patch commit ec2fbfbbdaa7d7db1c707dce26ce1a37cfe09660

Fix buffer overflow in struct bigname. CVE-2026-2291

All buffers capable of holding a domain name should be
at least MAXDNAME*2 + 1 bytes long, where MAXDNAME is the maximum
size of a domain name. The accounts for the trailing zero and the
fact that some characters are escaped in the internal representation
of a domain name in dnsmasq.

The declaration of struct bigname get this wrong, with the effect
that a remote attacker capable of asking DNS queries or answering DNS
queries can cause a large OOB write in the heap.

This was first spotted by Andrew S. Fasano.		 Simon Kelley <simon@thekelleys.org.uk> no 2026-04-10
CVE-2026-4890.patch commit de76f21e115c451cf0653790fc4b209cd4778a07

Fix NSEC bitmap parsing infinite loop. CVE-2026-4890

Report from Royce M <royce@xchglabs.com>.

Location: dnssec.c:1290-1306, dnssec.c:1450-1463

The bitmap window iteration advances by p[1] instead of p[1]+2 (missing the 2-byte window header). With bitmap_length=0, both rdlen and p are
unchanged, causing an infinite loop and dnsmasq stops responding to all queries.

The same code accesses p[2] after only checking rdlen >= 2 without verifying p[1] >= 1, causing OOB reads at 6 locations.

Both bugs are reachable before RRSIG validation (confirmed by the source comment at line 2125), so no valid DNSSEC signatures are needed.

diff --git a/src/dnssec.c b/src/dnssec.c
index 415c4e5..8672444 100644		 Simon Kelley <simon@thekelleys.org.uk> no 2026-04-10
CVE-2026-4891.patch commit 2cacea42e4d45717bd0ce3ccfe8e78960245e5da

Verify rdlen field in RRSIG packets. CVE-2026-4891

Bug report from Royce M <royce@xchglabs.com>

This avoids crafted packets which give a value for rdlen _less_
then the space taken up by the fixed data and the signer's name
and engender a negative calculated length for the signature.

diff --git a/src/dnssec.c b/src/dnssec.c
index 0860daa..4bb0495 100644		 Simon Kelley <simon@thekelleys.org.uk> no 2026-03-25
CVE-2026-4892.patch commit 011a36c51438c986535a7248ed2e7f424f8e1078

Fix buffer overflow in helper.c with large CLIDs. CVE-2026-4892

Bug reported bt Royce M <royce@xchglabs.com>

Location: helper.c:265-270
DHCPv6 CLIDs can be up to 65535 bytes. When --dhcp-script is configured,
the helper hex-encodes raw CLID bytes via sprintf("%.2x") into daemon->packet (5131 bytes).
A 1000-byte CLID writes ~3000 bytes. The helper process retains root privileges.

Note: log6_packet() correctly caps CLID to 100 bytes for logging, but the helper code path was missed.

diff --git a/src/helper.c b/src/helper.c
index 72f81fe..2c12801 100644		 Simon Kelley <simon@thekelleys.org.uk> no 2026-03-25
CVE-2026-4893.patch commit 434d68f2eb1a58744470698483a3ae09b5a9a870

Fix broken client subnet validation. CVE-2026-4893

Bug report from Royce M <royce@xchglabs.com>

Location: forward.c:713, edns0.c:421

With --add-subnet enabled, process_reply() passes the OPT record
length (~23 bytes) instead of the packet length to check_source().
All internal bounds checks fail, and the function always returns 1.
ECS source validation per RFC 7871 Section 9.2 is completely bypassed.		 Simon Kelley <simon@thekelleys.org.uk> no 2026-03-25
CVE-2026-5172.patch commit fa3c8ddef6712b52f562813317e6a997e1210123

Fix buffer overflow vulnerability in extract_addresses() CVE-2026-5172

Thanks to Hugo Martinez Ray for spotting this.

The value of rdlen for an RR can be a lie, allowing the
call to extract_name() at rfc1025.c:952 to advance the value of p1
past the calculated end of the record. The makes the calculation
of bytes remaining in the RR underflow to a huge number and results
in a massive heap OOB read and certain crash.		 Simon Kelley <simon@thekelleys.org.uk> no 2026-03-30
CVE-2026-12725.patch commit 36d081e37477027fd721fea498f3760f529034ad

Fix buffer overlow in log_query()

The addition of "(not supported)" to logs of DS and DNSKEY replies
overflows the buffer used to construct the string.

Re-arrange things to avoid this, and add checks to avoid the same problem
if the logging calls change in the future.

Thanks to Yiwei Hou for finding this.

The problem exists is DNSSEC is enabled and query logging is also
enabled. The overwrite is of bounded length and the bytes
written are not in control of an attacker, so this is not considered
a likely remote-execution vector.		 Simon Kelley <simon@thekelleys.org.uk> no 2026-04-21
CVE-2026-12969.patch commit 14094e88beca519c53151184cc4553656672b54f

Fix buffer OOB read in find_soa()

In find_soa() extract_name() is called with extrabytes=0 when parsing NS
record names, which means it only validates that the DNS name fits
within the packet but does not check that 10 additional bytes exist for
the type/class/TTL/rdlen fixed fields. Lines 546-549 then
unconditionally read these 10 bytes via GETSHORT/GETLONG macros. An
attacker controlling a DNS zone can craft a NXDOMAIN response where the
NS record name extends to the packet boundary, causing a 10-byte
out-of-bounds read past the valid packet data (CWE-125, CVSS 5.3
Medium). The read stays within the over-allocated packet buffer in
default configurations, limiting crash risk, but accesses data outside
the logical packet boundary. Under certain conditions, the overread may
access stale heap data from prior transactions.

The fix is straightforward: change the extrabytes
argument from 0 to 10, consistent with other call sites in
the same file.

Credit is due to do litli for finding this problem.		 do litli <dolitli02@gmail.com> no 2026-05-09

All known versions for source package 'dnsmasq'

Links