CVE-2026-93009
Description
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
Statement
This vulnerability is rated as Low because it is a 1-byte adjacent-network out-of-bounds read with no demonstrated leak or crash. The read value is used only to decide whether the parse loop continues. Red Hat products that ship dnsmasq with DHCPv6 compiled in may be affected when a DHCPv6 range is configured. RHEL 6 ships dnsmasq 2.48, which predates the introducing change. Later RHEL streams ship 2.76 or newer and include this parser.
Mitigation
The following measures reduce risk:
1. If DHCPv6 is not required, do not configure any IPv6 dhcp-range.
2. Compile without DHCPv6 using COPTS=-DNO_DHCP6 if IPv6 DHCP is not needed.
3. Restrict dnsmasq to trusted interfaces with --interface=<iface>.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | 4.3 |
| Attack Vector | Adjacent Network | N/A | Adjacent Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Red Hat CVSS v3 Score Explanation
Reporter assigned no CVSS score and could not demonstrate impact. RH scores 4.3 for a confirmed 1-byte adjacent-network OOB read with no demonstrated leak or crash.
Acknowledgements
Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
