Bug 2458517 (CVE-2026-4891)

Summary:	CVE-2026-4891 dnsmasq: RRSIG rdlen underflow leading to heap OOB read
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A heap out-of-bounds read vulnerability was discovered in dnsmasq's DNSSEC validation. When processing RRSIG records, dnsmasq calculates the signature length by subtracting the fixed field size from the record's declared data length. A crafted RRSIG record with a data length smaller than the fixed fields causes this calculation to underflow, potentially resulting in an out-of-bounds read and process crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-05-09

Description OSIDB Bzimport 2026-04-14 22:45:13 UTC

In validate_rrset() at dnssec.c:546, sig_len is calculated as rdlen - (p - psav) without checking that rdlen is large enough to cover the fixed RRSIG fields and signer name. A crafted RRSIG with a short rdlen makes sig_len go negative, which when passed as a size parameter becomes a huge unsigned value, causing a massive heap OOB read. Fix: check sig_len <= 0 and return STAT_BOGUS before using it.

Comment 2 errata-xmlrpc 2026-05-19 16:10:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19158 https://access.redhat.com/errata/RHSA-2026:19158

Comment 3 errata-xmlrpc 2026-05-19 21:41:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19373 https://access.redhat.com/errata/RHSA-2026:19373

Comment 4 errata-xmlrpc 2026-05-26 04:57:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:20589 https://access.redhat.com/errata/RHSA-2026:20589

Comment 5 errata-xmlrpc 2026-07-01 21:09:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:34508 https://access.redhat.com/errata/RHSA-2026:34508

Comment 6 errata-xmlrpc 2026-07-22 12:54:56 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2026:40762 https://access.redhat.com/errata/RHSA-2026:40762