CVE-2026-12725: dnsmasq Heap Buffer Overflow (DNSSEC + Logging) – Denial of Service

Technical summary

CVE-2026-12725 is a heap-based buffer overflow in dnsmasq's logging subsystem, specifically affecting the handling of DNSSEC-related records (DS and DNSKEY replies) with unsupported cryptographic algorithms or digest types. The vulnerability exists because the logging buffer does not properly validate the size of data being written when processing these records. An attacker-controlled DNS response containing a malformed DS or DNSKEY record triggers out-of-bounds writes, corrupting heap memory and crashing the dnsmasq process. The flaw is assigned CWE-122 (Heap-based Buffer Overflow). Exploitation requires both DNSSEC validation and query logging to be enabled—a configuration common in enterprise and ISP deployments but not universal.

Business impact

Organizations running dnsmasq as their primary or secondary DNS resolver face intermittent service unavailability. Each successful exploitation causes dnsmasq to crash, interrupting DNS resolution for all dependent systems and applications until manual or automated recovery restarts the service. In environments without redundant DNS infrastructure, this directly impacts user-facing services. The impact is amplified in containerized deployments (Red Hat OpenShift) where DNS is a critical cluster service. Reputational and operational costs stem from degraded service availability rather than data loss, since the vulnerability does not compromise confidentiality or integrity.

Affected systems

The vulnerability affects dnsmasq across multiple deployments: the upstream dnsmasq project itself, Red Hat Enterprise Linux (RHEL) across multiple versions where dnsmasq is included, and Red Hat OpenShift Container Platform, which relies on dnsmasq for DNS services. Exposure depends on configuration: systems running dnsmasq with both DNSSEC validation and query logging enabled are at risk. Systems using dnsmasq in forwarding-only mode or without DNSSEC validation are not vulnerable, even if query logging is active.

Exploitability

Exploitation requires network access to the targeted dnsmasq instance and the ability to craft and send a malicious DNS response. The CVSS score of 5.9 (MEDIUM) reflects this: the attack vector is network-based (AV:N), but the attack complexity is high (AC:H) because both DNSSEC validation and query logging must be enabled simultaneously. The attacker must also predict or observe legitimate DNS queries to respond to them. No authentication is required (PR:N), and user interaction is not necessary (UI:N). The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, indicating no active wild exploitation at the time of publication, though the technical barrier is moderate rather than high.

Remediation

The primary remediation is to update dnsmasq to a patched version that validates logging buffer sizes before writing DNSSEC record data. Verify the specific patched version available for your distribution through the vendor advisory. Interim mitigations include: (1) disabling DNSSEC validation if it is not operationally required; (2) disabling query logging if comprehensive DNS audit trails are not mandated; (3) running dnsmasq behind a firewall that restricts DNS responses to legitimate upstream resolvers only, reducing the attacker's ability to inject malicious responses; (4) implementing process restart automation so that crashes are immediately detected and the service recovers without manual intervention.

Patch guidance

Check your Linux distribution's security advisory for dnsmasq updates. Red Hat users should consult Red Hat Security Advisories (RHSA) for RHEL and OpenShift patches. Verify the patched version in the advisory matches your package manager's available version. For upstream dnsmasq, consult thekelleys.org.uk/dnsmasq for the latest release notes. Test patches in a non-production environment first, particularly if dnsmasq serves as a critical resolver. After patching, confirm that DNSSEC validation and query logging remain functional and that no configuration changes are needed.

Detection guidance

Monitor dnsmasq process crashes or restarts using system monitoring tools (auditd, systemd journal, syslog). Set alerts for unexpected dnsmasq terminations, especially if they occur in bursts. Enable verbose logging in dnsmasq to capture algorithm or digest type mismatches in DNSSEC validation—these may appear as error messages preceding a crash. Network-based detection is difficult because the malicious DNS response appears legitimate; detection relies on behavioral indicators (service crashes) rather than packet inspection. In containerized environments, monitor pod restarts of dnsmasq containers.

Why prioritize this

Although the CVSS score is MEDIUM (5.9) and exploitation requires two specific configuration settings to be active, this vulnerability merits prompt attention because: (1) DNS service availability is critical to nearly all enterprise operations; (2) the exploitation preconditions (DNSSEC validation + query logging) are common in security-conscious and regulated organizations; (3) the attacker requires only network access and low technical complexity; (4) no active exploitation has been observed, providing a window to patch before threat actors weaponize this vector; (5) the fix is a straightforward software update with no known breaking changes.

Risk score, explained

The CVSS v3.1 score of 5.9 reflects a network-accessible denial-of-service vulnerability with moderate exploitation complexity. The 'High' impact on Availability (A:H) acknowledges that successful exploitation crashes the service. The 'No' impact on Confidentiality and Integrity (C:N/I:N) and unchanged scope (S:U) cap the severity to MEDIUM. The high attack complexity (AC:H) is the primary mitigating factor, as the attacker must engineer conditions where both DNSSEC validation and query logging are enabled. In environments where these are universally configured, the practical severity is elevated; in environments where either is disabled, risk is near zero.

Frequently asked questions