CVE-2026-93007
Description
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
Statement
This vulnerability is rated as Moderate because UDP DNS continues during exhaustion, the effect auto-recovers after 150 seconds unless the attacker reconnects, and availability impact is Low rather than High. Only TCP-dependent operations (DNSSEC TCP fallback, zone transfers, TCP-only clients) are disrupted. Red Hat products that ship dnsmasq as a DNS forwarder are affected. Administrators can raise --max-tcp-connections and apply firewall connection limits.
Mitigation
The following measures reduce risk:
1. Increase the TCP connection limit with --max-tcp-connections=<N> to raise the number of connections an attacker must hold.
2. Limit per-source TCP connections to port 53 with firewall rules, for example iptables connlimit on tcp/53.
3. Restrict which hosts can reach TCP port 53 if TCP DNS is not required from untrusted networks.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat CVSS v3 Score Explanation
Reporter scored 7.5 (A:H). RH scores 5.3 (A:L) because UDP DNS continues, slots auto-recover after 150 seconds, and only TCP-dependent operations are disrupted.
Acknowledgements
Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
