Bug 2501769

Summary: CVE-2026-12725 dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies [fedora-all]
Product: [Fedora] Fedora Reporter: Samuele Negrini <snegrini>
Component: dnsmasqAssignee: Petr Menšík <pemensik>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: dns-sig, dougsland, pemensik
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["a7c22b03-5aae-443d-91ec-73707f34784b"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-07-17 15:52:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2490763    

Description Samuele Negrini 2026-07-17 15:26:27 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A heap buffer overflow exists in dnsmasq's log_query() function (src/cache.c).
When query logging is enabled and dnsmasq logs DS or DNSKEY replies containing
unsupported algorithm or digest types, the "(not supported)" suffix causes
sprintf() to write past the end of daemon->addrbuff, a 46-byte heap buffer.
Trigger example: a DS record with key_tag=65535, algorithm=255, digest_type=255
(both algorithm 255 and digest_type 255 are IANA-unassigned), causing the
"(not supported)" branch in dnssec.c to fire during logging.
Prerequisites:
- DNSSEC validation enabled
- Query logging enabled (e.g. --log-queries)
Impact: bounded heap write overflow (~12 bytes). Upstream maintainer Simon Kelley
notes the overwrite is of bounded length, the bytes written are not
attacker-controlled, and this is not considered a likely remote-execution vector.
Practical impact is denial of service via process crash or heap corruption.
Fixed upstream in commit 36d081e37477027fd721fea498f3760f529034ad (dnsmasq 2.92rel2).
Comment 1 Petr Menšík 2026-07-17 15:52:05 UTC 

*** This bug has been marked as a duplicate of bug 2484748 ***
Comment 2 Petr Menšík 2026-07-17 18:32:45 UTC 
This is fixed by 2.93 update. It should be in all 2.92rel2 updates in stable versions too. That doesn't seem to have own tag nor branch.