Bug 2536079 (CVE-2026-93008) - CVE-2026-93008 dnsmasq: dnsmasq: out-of-bailiwick cache injection through CNAME chase in split-DNS configurations
Summary: CVE-2026-93008 dnsmasq: dnsmasq: out-of-bailiwick cache injection through CNA...
Keywords:
Status: NEW
Alias: CVE-2026-93008
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 14:52 UTC by OSIDB Bzimport
Modified: 2026-10-28 09:36 UTC (History)
35 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 14:52:25 UTC 
An insufficient authenticity check was found in dnsmasq's DNS CNAME chase logic in src/rfc1035.c. When a response contains a CNAME, dnsmasq replaces the tracked query name with the CNAME target and rescans the answer section (cname_loop), then cache_insert()s matching records. There is no bailiwick validation that those records fall within the responding server's zone of authority. Source inspection finds no bailiwick checks anywhere in dnsmasq.

In split-DNS configurations (server=/domain/ip), this lets an attacker who controls a delegated upstream inject a CNAME to an unrelated name plus a forged address record. dnsmasq caches the forged record for all clients, escaping the server=/domain/ containment boundary.

A related issue exists in find_soa() (rfc1035.c), introduced in v2.90 (commit 12ddb2a4): SOA suffix matching uses raw memcmp without a DNS label-boundary check, unlike in_zone() and domain_no_rebind().

F3a (missing bailiwick on CNAME chase): all versions.
F3b (find_soa label-boundary): v2.90 onwards.
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743
Note You need to log in before you can comment on or make changes to this bug.