CVE-2026-2291

HIGH EPSS 50.4%
Published May 11, 20261mo ago · Modified Jun 17, 20261w ago
7.3 CVSS 3.1
High
Find Similar
Published May 11, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.

CVSS Details

Base Score
7.3
Exploitability
3.9
Impact
3.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
50.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

References 7

  • github.com https://github.com/NixOS/nixpkgs/pull/519082
  • github.com https://github.com/NixOS/nixpkgs/pull/519093
  • github.com https://github.com/pi-hole/FTL/releases/tag/v6.6.2
  • lists.thekelleys.org.uk https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html
  • thekelleys.org.uk https://thekelleys.org.uk/dnsmasq/CVE/
  • kb.cert.org https://www.kb.cert.org/vuls/id/471747
  • suse.com https://www.suse.com/security/cve/CVE-2026-2291.html

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.