dnsmasq Vulnerable to Denial-of-Service via DNSSEC NSEC/NSEC3 Record Manipulation
A denial-of-service vulnerability in dnsmasq allows unauthenticated remote attackers to crash affected servers by sending crafted DNSSEC records.
The popular DNS forwarding server, dnsmasq, is susceptible to a denial-of-service (DoS) vulnerability that could allow remote attackers to disrupt network services. The vulnerability, tracked as CVE-2026-4890, stems from improper processing of DNSSEC NSEC (Next Secure) and NSEC3 (Next Secure 3) type bitmap records.
Attackers can exploit this flaw by sending specially crafted DNSSEC records to an affected dnsmasq instance. The malformed records trigger an infinite loop within the dnsmasq software, consuming excessive system resources and ultimately leading to a denial-of-service condition. This means that the server becomes unresponsive, preventing legitimate DNS queries from being resolved.
A critical aspect of this vulnerability is that it does not require any form of authentication to exploit. This significantly lowers the barrier to entry for potential attackers, as they do not need prior access or credentials to target vulnerable systems. The ease of exploitation, combined with the potential for widespread disruption, makes this a concerning issue for network administrators.
The Zero Day Initiative (ZDI), which disclosed the vulnerability, has assigned it a CVSS score of 7.5, classifying it as High severity. This score reflects the impact of the vulnerability, considering factors such as its exploitability, the privileges required, and the potential consequences for confidentiality, integrity, and availability.
dnsmasq is widely used in various network environments, including home routers, small business networks, and even larger enterprise infrastructures, often as a caching DNS forwarder or DHCP server. Its prevalence means that a successful exploit could affect a considerable number of devices and users, potentially leading to widespread internet connectivity issues.
While the ZDI advisory does not detail specific patches or mitigation steps, users of dnsmasq are strongly advised to monitor for security updates from the dnsmasq project or their distribution vendors. In the interim, network security teams may consider implementing firewall rules to restrict access to dnsmasq instances from untrusted networks or employing intrusion detection/prevention systems to identify and block malicious DNS traffic patterns.
This vulnerability highlights the ongoing challenges in securing DNS infrastructure, particularly with the increasing complexity of DNSSEC validation. As DNSSEC adoption grows, so does the potential attack surface for vulnerabilities within the DNS resolution and forwarding software. Organizations relying on dnsmasq should prioritize applying any available security patches promptly to protect their networks from this DoS threat.