Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2026-12725: dnsmasq may crash and halt DNS when logging unexpected replies
CVE-2026-12725 · published 4 months ago
Summary
The dnsmasq program used on Debian, Canonical, BellSoft and Red Hat Enterprise Linux 6 and 10 can stop working if it logs certain DNS responses while DNSSEC validation is enabled. A malicious server could send a specially crafted reply that triggers the crash, causing DNS service to stop. Update dnsmasq to the latest version or disable DNSSEC validation or query logging until the fix is applied.
What to do
- Update debian dnsmasq to version 2.93-1.
- Update canonical dnsmasq to version 2.92-1ubuntu0.4.
- Update canonical dnsmasq to version 2.90-0ubuntu0.16.04.1+esm4.
- Update canonical dnsmasq to version 2.90-0ubuntu0.18.04.1+esm4.
- Update canonical dnsmasq to version 2.90-0ubuntu0.20.04.1+esm3.
- Update canonical dnsmasq to version 2.90-0ubuntu0.22.04.4.
- Update canonical dnsmasq to version 2.90-2ubuntu0.4.
- Update bellsoft dnsmasq to version 2.93-r0.
- Update debian dnsmasq to version 2.91-1+deb13u2.
- Update thekelleys dnsmasq to version 2.93 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | dnsmasq | All versions |
| Debian:12 | debian | dnsmasq | All versions |
| Debian:13 | debian | dnsmasq |
< 2.91-1+deb13u2 Fix: upgrade to 2.91-1+deb13u2
|
| Debian:14 | debian | dnsmasq |
< 2.93-1 Fix: upgrade to 2.93-1
|
| Ubuntu:26.04:LTS | canonical | dnsmasq |
< 2.92-1ubuntu0.4 Fix: upgrade to 2.92-1ubuntu0.4
|
| Ubuntu:Pro:16.04:LTS | canonical | dnsmasq |
< 2.90-0ubuntu0.16.04.1+esm4 Fix: upgrade to 2.90-0ubuntu0.16.04.1+esm4
|
| Ubuntu:Pro:18.04:LTS | canonical | dnsmasq |
< 2.90-0ubuntu0.18.04.1+esm4 Fix: upgrade to 2.90-0ubuntu0.18.04.1+esm4
|
| Ubuntu:Pro:20.04:LTS | canonical | dnsmasq |
< 2.90-0ubuntu0.20.04.1+esm3 Fix: upgrade to 2.90-0ubuntu0.20.04.1+esm3
|
| Ubuntu:22.04:LTS | canonical | dnsmasq |
< 2.90-0ubuntu0.22.04.4 Fix: upgrade to 2.90-0ubuntu0.22.04.4
|
| Ubuntu:24.04:LTS | canonical | dnsmasq |
< 2.90-2ubuntu0.4 Fix: upgrade to 2.90-2ubuntu0.4
|
| Ubuntu:25.10 | canonical | dnsmasq | All versions |
| Alpaquita:stream | bellsoft | dnsmasq |
>= 2.89-r2, < 2.93-r0 Fix: upgrade to 2.93-r0
|
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 6 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| – | red hat | red hat openshift container platform 4 | All versions |
| – | redhat | openshift_container_platform |
>= 4.0, <= 4.22.1 cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
8.0 9.0 10.0 cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| – | thekelleys | dnsmasq |
< 2.93 cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:* |
Original advisory text
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can ca...
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.
References
- https://security-tracker.debian.org/tracker/CVE-2026-12725 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8542-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-12725 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-12725 Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-12725 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-12725 Mitigation Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2490763 Issue Tracking Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published22 Jun 2026
Updated4 Nov 2026
First seen22 Jun 2026
Sources
CVE-2026-12725 · NVD
CVE-2026-12725 · MITRE
UBUNTU-CVE-2026-12725 · OSV
BELL-CVE-2026-12725 · OSV
DEBIAN-CVE-2026-12725 · OSV
Track software like this
Free during beta