CVE-2026-93010
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A flaw was found in dnsmasq: when DHCP leasequery is enabled without an allowed source address list, the server does not verify who sent the query. A host on the local network can query DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator enables it.
Risk Assessment
An attacker on the local network can obtain information about devices and DHCP leases, facilitating further attacks. The risk applies only to configurations with leasequery enabled and no source restrictions.
Recommendation
Configure an allowed source address list for DHCP leasequery or disable the feature if not needed. Update dnsmasq to a version containing the fix.
Other vulnerabilities in dnsmasq
See all- CVE-2026-4893Medium
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet carrying RFC 7871 client subnet information. The flaw enables circumvention of query origin verification mechanisms.
- CVE-2017-14496High
An integer underflow in the add_pseudoheader function in dnsmasq before version 2.78 allows remote attackers to cause a denial of service via a crafted DNS request when the --add-mac, --add-cpe-id, or --add-subnet option is specified.
- CVE-2017-14495High
A memory leak in dnsmasq before version 2.78 occurs when the --add-mac, --add-cpe-id, or --add-subnet option is specified. This allows remote attackers to cause a denial of service through DNS response creation manipulation.
- CVE-2017-13704High
In dnsmasq before version 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zeros, causing dnsmasq to crash.
- CVE-2015-8899High
Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
- CVE-2026-4891Medium
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
- CVE-2026-4890High
The DNSSEC validation in dnsmasq has a denial of service (DoS) vulnerability. A remote attacker can send a crafted DNS packet, causing the service to crash.
- CVE-2017-14491Critical
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
- CVE-2017-14493Critical
A stack-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.
- CVE-2017-14492Critical
Heap-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.
Original NVD description (English source)
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS