dnsmasq CVE-2026-6507: Out-of-bounds write in DHCP BOOTREPLY causing DoS

Bug 2459191 (CVE-2026-6507) - dnsmasq: Denial of Service due to out-of-bounds write in DHCP BOOTREPLY processing Vulnerability Overview In version 2.92, when using the option, the server-side processing of packets may place at the end of a 552-byte packet. If a malicious variant follows immediately, it can cause to crash. Impact Scope Product: Security Response Component: vulnerability Operating System: Linux Priority: medium Severity: medium Remediation Plan Status: NEW Reported Time: 2026-04-17 11:39 UTC by OSGDB Bzimport Modified Time: 2026-04-17 12:24 UTC CC List: 0 users Fixed Version: Not specified Close Reason: Not specified Environment: Not specified Last Closed: Not specified Embargoed: Not specified Detailed Information Target Milestone: Not specified Assigned To: Product Security DevOps Team QA Contact: Not specified Documentation Contact: Not specified URL: Not specified Whiteboard: Not specified Dependencies: 2459195, 2459196 Blocks: Not specified TreeView: depends on / blocked Attachments Description: - In 2.92, the server-side processing of packets may place at the end of a 552-byte packet. If a malicious variant follows immediately, it can cause to crash. - In the PoC, a legitimate 552-byte keeps the daemon alive, while the malicious variant causes to crash. - The attached PoC also reproduces the direct address sanitizer report in . Code Block Notes You must be logged in to comment on or make changes to this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

dnsmasq CVE-2026-6507: Out-of-bounds write in DHCP BOOTREPLY causing DoS