CVE-2015-8899
HighSummary
Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
Risk Assessment
Organizations may experience service interruptions due to DNS availability issues, potentially disrupting applications and systems reliant on DNS.
Recommendation
It is recommended to upgrade Dnsmasq to version 2.76 or later to mitigate this vulnerability.
Other vulnerabilities in Dnsmasq
See all- CVE-2026-4893Medium
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet carrying RFC 7871 client subnet information. The flaw enables circumvention of query origin verification mechanisms.
- CVE-2017-14496High
An integer underflow in the add_pseudoheader function in dnsmasq before version 2.78 allows remote attackers to cause a denial of service via a crafted DNS request when the --add-mac, --add-cpe-id, or --add-subnet option is specified.
- CVE-2017-14495High
A memory leak in dnsmasq before version 2.78 occurs when the --add-mac, --add-cpe-id, or --add-subnet option is specified. This allows remote attackers to cause a denial of service through DNS response creation manipulation.
- CVE-2017-13704High
In dnsmasq before version 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zeros, causing dnsmasq to crash.
- CVE-2026-4891Medium
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
- CVE-2026-4890High
The DNSSEC validation in dnsmasq has a denial of service (DoS) vulnerability. A remote attacker can send a crafted DNS packet, causing the service to crash.
- CVE-2017-14491Critical
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
- CVE-2017-14493Critical
A stack-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.
- CVE-2017-14492Critical
Heap-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.
- CVE-2026-93010Medium
A flaw was found in dnsmasq: when DHCP leasequery is enabled without an allowed source address list, the server does not verify who sent the query. A host on the local network can query DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator enables it.
Original NVD description (English source)
Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS