Dnsmasq DNSSEC Vulnerability Leads to Denial-of-Service

A critical denial-of-service vulnerability, identified as CVE-2026-4890, has been disclosed in Dnsmasq, a widely used DNS forwarder and DHCP server. The flaw, which received a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), allows remote attackers to trigger an infinite loop by sending specially crafted DNSSEC NSEC/NSEC3 records, leading to a denial-of-service condition.

The vulnerability stems from improper processing of NSEC records, specifically within the NSEC/NSEC3 Type Bitmap, where a lack of a proper exit condition in a loop can be exploited. Attackers do not need to authenticate to leverage this flaw, making it a significant remote attack vector.

The issue was reported to the vendor on May 20, 2026, by a researcher identified as chwrld. A coordinated public release of the advisory occurred on August 13, 2026.

Dnsmasq has confirmed the vulnerability and released a patch in version 2.93. Users of Dnsmasq are strongly advised to update their installations to this version or newer to mitigate the risk of exploitation. The vulnerability is tracked under ZDI-26-584 and ZDI-CAN-30607.