Log in Start free

Vulnerability · Published May 11, 2026 · Assigned by certcc

CVE-2026-4890CVE-2026-4890

High 7.5

In plain English

A high-severity infinite loop in dnsmasq from dnsmasq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.8% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)8.8%top 4.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10dnsmasq2.90-7.el10_2ALSA-2026:19158
AlmaLinux:8dnsmasq2.79-36.el8_10ALSA-2026:20589
AlmaLinux:9dnsmasq2.85-18.el9_8.1ALSA-2026:19373
AlmaLinux:10dnsmasq-utils2.90-7.el10_2ALSA-2026:19158
AlmaLinux:8dnsmasq-utils2.79-36.el8_10ALSA-2026:20589
AlmaLinux:9dnsmasq-utils2.85-18.el9_8.1ALSA-2026:19373
Alpine:v3.22dnsmasq2.91-r1ALPINE-CVE-2026-4890
Alpine:v3.23dnsmasq2.91-r1ALPINE-CVE-2026-4890
Alpine:v3.24dnsmasq2.92_p2-r0ALPINE-CVE-2026-4890
Debian:12dnsmasq2.90-4~deb12u2DEBIAN-CVE-2026-4890
Debian:13dnsmasq2.91-1+deb13u1DEBIAN-CVE-2026-4890
Debian:14dnsmasq2.92-5DEBIAN-CVE-2026-4890
Rocky Linux:10dnsmasq0:2.90-7.el10_2RLSA-2026:19158
Rocky Linux:8dnsmasq0:2.79-36.el8_10RLSA-2026:20589
Rocky Linux:9dnsmasq0:2.85-18.el9_8.1RLSA-2026:19373
Ubuntu:22.04:LTSdnsmasq2.90-0ubuntu0.22.04.3UBUNTU-CVE-2026-4890
Ubuntu:24.04:LTSdnsmasq2.90-2ubuntu0.3UBUNTU-CVE-2026-4890
Ubuntu:25.10dnsmasq2.91-1ubuntu0.2UBUNTU-CVE-2026-4890
Ubuntu:26.04:LTSdnsmasq2.92-1ubuntu0.2UBUNTU-CVE-2026-4890

Affected products (as reported)

VendorProductVersions
dnsmasq dnsmasq 0 – before 2.92rel2

Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References