CVE-2026-12725A heap-based buffer overflow was found in dnsmasq.
Updated under an hour ago ()
Does this affect you?
It affects redhat openshift_container_platform and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.
- CVSS
- 5.9 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-122
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Aug 31, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
redhat openshift_container_platform redhat:openshift_container_platform | from 4.0 through 4.22.1 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 8.0; 9.0; 10.0 | NVD |
thekelleys dnsmasq thekelleys:dnsmasq | before 2.93 | NVD |
References
- https://access.redhat.com/security/cve/CVE-2026-12725mitigation, vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2490763issue-tracking, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.