Bug 2536082 (CVE-2026-93011)

Summary:	CVE-2026-93011 dnsmasq: dnsmasq: heap out-of-bounds write in DNSSEC validator via to_wire/from_wire transforms
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bniver, dpaolell, eglynn, flucifre, gmeno, groman, jdelft, jjoyce, jpretori, jschluet, jupierce, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, sostapov, suppawar, vereddy, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-17 14:54:39 UTC

A heap out-of-bounds write was found in dnsmasq's DNSSEC validator, as a follow-on to the buffer reduction in commit 014e909 (CVE-2026-2291). That commit shrank domain-name buffers from 2051 bytes to MAXDNAMESTR+1 (504 bytes). The in-place to_wire() and from_wire() transforms in src/rrfilter.c were not given length parameters and can write 1-3 bytes past a 504-byte buffer when processing near-maximal names during DNSSEC validation (wildcard stripping in validate_rrset, and NSEC3 hash_name round-trip).

This is a distinct issue from CVE-2026-2291. CVE-2026-2291 was the original storage-allocation rework. This finding is an OOB write that became reachable after that shrink.

The overwrite lands on adjacent heap chunk metadata of a startup allocation that is never freed. Reporter observed zero crashes in 120 trigger attempts. HAVE_DNSSEC is commented out by default (config.h). Runtime requires --dnssec and --trust-anchor.

Affected versions: v2.93 through HEAD. Unaffected: v2.92 and earlier (2051-byte name buffers). Standalone CVE-2026-2291.diff on v2.91/v2.92 does not shrink these buffers and is not affected by this follow-on.
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743