A resource-exhaustion issue was found in dnsmasq's TCP DNS handler. Incoming TCP connections on port 53 cause fork() of a child process tracked in fixed-size tcp_pids/tcp_pipes arrays bounded by MAX_PROCS (default 30, configurable via --max-tcp-connections). Children block on read_write() of the client socket with no SO_RCVTIMEO. The only timeout is CHILD_LIFETIME (150 seconds via SIGALRM).

An unauthenticated remote attacker can open MAX_PROCS idle TCP connections and hold all slots for up to 150 seconds. During exhaustion, set_dns_listeners() stops polling TCP listen sockets, and DNSSEC swap_to_tcp() (which shares the same slot pool) returns STAT_ABANDONED. UDP DNS continues to function.

This is a slowloris-style exhaustion of the fork-per-connection TCP architecture. SO_RCVTIMEO is already applied to upstream server sockets (forward.c) but not to accepted client sockets.

Affected versions: all current versions (fundamental TCP architecture).
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743