Log in Start free

Vulnerability · Published May 11, 2026 · Assigned by certcc

CVE-2026-4893CVE-2026-4893

Medium 5.3

In plain English

A medium-severity security flaw in dnsmasq from dnsmasq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.8%top 21.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10dnsmasq2.90-7.el10_2ALSA-2026:19158
AlmaLinux:8dnsmasq2.79-36.el8_10ALSA-2026:20589
AlmaLinux:9dnsmasq2.85-18.el9_8.1ALSA-2026:19373
AlmaLinux:10dnsmasq-utils2.90-7.el10_2ALSA-2026:19158
AlmaLinux:8dnsmasq-utils2.79-36.el8_10ALSA-2026:20589
AlmaLinux:9dnsmasq-utils2.85-18.el9_8.1ALSA-2026:19373
Alpine:v3.22dnsmasq2.91-r1ALPINE-CVE-2026-4893
Alpine:v3.23dnsmasq2.91-r1ALPINE-CVE-2026-4893
Alpine:v3.24dnsmasq2.92_p2-r0ALPINE-CVE-2026-4893
Debian:12dnsmasq2.90-4~deb12u2DEBIAN-CVE-2026-4893
Debian:13dnsmasq2.91-1+deb13u1DEBIAN-CVE-2026-4893
Debian:14dnsmasq2.92-5DEBIAN-CVE-2026-4893
Rocky Linux:10dnsmasq0:2.90-7.el10_2RLSA-2026:19158
Rocky Linux:8dnsmasq0:2.79-36.el8_10RLSA-2026:20589
Rocky Linux:9dnsmasq0:2.85-18.el9_8.1RLSA-2026:19373
Ubuntu:22.04:LTSdnsmasq2.90-0ubuntu0.22.04.3UBUNTU-CVE-2026-4893
Ubuntu:24.04:LTSdnsmasq2.90-2ubuntu0.3UBUNTU-CVE-2026-4893
Ubuntu:25.10dnsmasq2.91-1ubuntu0.2UBUNTU-CVE-2026-4893
Ubuntu:26.04:LTSdnsmasq2.92-1ubuntu0.2UBUNTU-CVE-2026-4893

Affected products (as reported)

VendorProductVersions
dnsmasq dnsmasq 0 – before 2.92rel2

References