CVE-2026-6507 PUBLISHED

Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing

Assigner: redhat
Reserved: 17.04.2026 Published: 17.04.2026 Updated: 17.04.2026

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the --dhcp-split-relay option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected

Workarounds

To mitigate this issue, ensure that the dnsmasq service is not configured with the --dhcp-split-relay option. If this option is currently in use, remove it from the dnsmasq configuration. After modifying the configuration, the dnsmasq service must be restarted for the changes to take effect. This may temporarily interrupt DHCP and DNS services provided by dnsmasq.

References

Problem Types

  • Out-of-bounds Write CWE