Bug 2490763 (CVE-2026-12725)

Summary:	CVE-2026-12725 dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2484748, 2501769
Bug Blocks:

Description OSIDB Bzimport 2026-06-19 14:44:48 UTC

A heap buffer overflow exists in dnsmasq's log_query() function (src/cache.c).
When query logging is enabled and dnsmasq logs DS or DNSKEY replies containing
unsupported algorithm or digest types, the "(not supported)" suffix causes
sprintf() to write past the end of daemon->addrbuff, a 46-byte heap buffer.
Trigger example: a DS record with key_tag=65535, algorithm=255, digest_type=255
(both algorithm 255 and digest_type 255 are IANA-unassigned), causing the
"(not supported)" branch in dnssec.c to fire during logging.
Prerequisites:
- DNSSEC validation enabled
- Query logging enabled (e.g. --log-queries)
Impact: bounded heap write overflow (~12 bytes). Upstream maintainer Simon Kelley
notes the overwrite is of bounded length, the bytes written are not
attacker-controlled, and this is not considered a likely remote-execution vector.
Practical impact is denial of service via process crash or heap corruption.
Fixed upstream in commit 36d081e37477027fd721fea498f3760f529034ad (dnsmasq 2.92rel2).