Advisories ยป MGASA-2026-0288

Updated dnsmasq packages fix security vulnerabilities

Publication date: 23 Jul 2026
Modification date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-12725 , CVE-2026-12969

Description

The updated dnsmasq packages fix multiple security issues:
A heap-based buffer overflow was found in dnsmasq. When DNSSEC
validation and query logging are both enabled, logging of DS or DNSKEY
replies containing unsupported algorithm or digest types can cause
dnsmasq to write past the end of an internal logging buffer.
A remote attacker able to supply such a DNS response may crash the
dnsmasq process, resulting in denial of service. (CVE-2026-12725)
An out-of-bounds read vulnerability exists in dnsmasq's find_soa()
function in src/rfc1035.c. When parsing NS section records,
extract_name() is called with extrabytes=0, failing to validate that 10
additional bytes exist for fixed-length DNS record fields. A remote
attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN
response to cause a 10-byte heap out-of-bounds read, potentially
accessing stale data from prior transactions. (CVE-2026-12969)

References

SRPMS

10/core

9/core