CVE-2026-93011 Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-93011?
CVE-2026-93011 is a medium-severity vulnerability in Red Hat Ceph Storage 9, published on 29 Oct 2026.
Official description
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
Weakness: CWE-787
Which versions are affected by CVE-2026-93011?
How do I fix CVE-2026-93011?
No fix has been published for CVE-2026-93011 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93011 being exploited?
There is no known exploitation of CVE-2026-93011 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93011, GHSA-2jq5-wc7q-j2fc.