Vulnerability · Published May 11, 2026 · Assigned by certcc
CVE-2026-2291CVE-2026-2291
High 7.3
In plain English
A high-severity security flaw in dnsmasq from dnsmasq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | dnsmasq | 2.90-7.el10_2 | ALSA-2026:19158 |
| AlmaLinux:8 | dnsmasq | 2.79-36.el8_10 | ALSA-2026:20589 |
| AlmaLinux:9 | dnsmasq | 2.85-18.el9_8.1 | ALSA-2026:19373 |
| AlmaLinux:10 | dnsmasq-utils | 2.90-7.el10_2 | ALSA-2026:19158 |
| AlmaLinux:8 | dnsmasq-utils | 2.79-36.el8_10 | ALSA-2026:20589 |
| AlmaLinux:9 | dnsmasq-utils | 2.85-18.el9_8.1 | ALSA-2026:19373 |
| Alpine:v3.22 | dnsmasq | 2.91-r1 | ALPINE-CVE-2026-2291 |
| Alpine:v3.23 | dnsmasq | 2.91-r1 | ALPINE-CVE-2026-2291 |
| Alpine:v3.24 | dnsmasq | 2.92_p2-r0 | ALPINE-CVE-2026-2291 |
| Debian:12 | dnsmasq | 2.90-4~deb12u2 | DEBIAN-CVE-2026-2291 |
| Debian:13 | dnsmasq | 2.91-1+deb13u1 | DEBIAN-CVE-2026-2291 |
| Debian:14 | dnsmasq | 2.92-5 | DEBIAN-CVE-2026-2291 |
| Rocky Linux:10 | dnsmasq | 0:2.90-7.el10_2 | RLSA-2026:19158 |
| Rocky Linux:8 | dnsmasq | 0:2.79-36.el8_10 | RLSA-2026:20589 |
| Rocky Linux:9 | dnsmasq | 0:2.85-18.el9_8.1 | RLSA-2026:19373 |
| Ubuntu:22.04:LTS | dnsmasq | 2.90-0ubuntu0.22.04.3 | UBUNTU-CVE-2026-2291 |
| Ubuntu:24.04:LTS | dnsmasq | 2.90-2ubuntu0.3 | UBUNTU-CVE-2026-2291 |
| Ubuntu:25.10 | dnsmasq | 2.91-1ubuntu0.2 | UBUNTU-CVE-2026-2291 |
| Ubuntu:26.04:LTS | dnsmasq | 2.92-1ubuntu0.2 | UBUNTU-CVE-2026-2291 |
Affected products (as reported)
References
- https://www.suse.com/security/cve/CVE-2026-2291.html
- https://www.kb.cert.org/vuls/id/471747
- https://thekelleys.org.uk/dnsmasq/CVE/
- https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html
- https://github.com/NixOS/nixpkgs/pull/519082
- https://github.com/NixOS/nixpkgs/pull/519093
- https://github.com/pi-hole/FTL/releases/tag/v6.6.2
- http://www.openwall.com/lists/oss-security/2026/07/20/14