CVE-2026-4893

Name

CVE-2026-4893

Description

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.

NVD Severity

unknown

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

References

Type	URI
cret@cert.org	https://thekelleys.org.uk/dnsmasq/
cret@cert.org	https://www.kb.cert.org/vuls/id/471747
cret@cert.org	https://github.com/NixOS/nixpkgs/pull/519082
cret@cert.org	https://github.com/NixOS/nixpkgs/pull/519093
cret@cert.org	https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html
cret@cert.org	https://thekelleys.org.uk/dnsmasq/CVE/
cret@cert.org	https://github.com/pi-hole/FTL/releases/tag/v6.6.2

Match rules

CPE URI	Source package	Min version	Max version

Vulnerable and fixed packages

Source package	Branch	Version	Maintainer	Status
dnsmasq	edge-main	2.92_p2-r0	Natanael Copa <ncopa@alpinelinux.org>	fixed
dnsmasq	3.24-main	2.92_p2-r0	Natanael Copa <ncopa@alpinelinux.org>	fixed
dnsmasq	3.23-main	2.91-r1	Natanael Copa <ncopa@alpinelinux.org>	fixed
dnsmasq	3.22-main	2.91-r1	Natanael Copa <ncopa@alpinelinux.org>	fixed