CVE-2026-12725

The record

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

Affected packages

Related vulnerabilities

• CVE-2026-2291 dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing… Also affects dnsmasq
• CVE-2026-6507 A flaw was found in dnsmasq. Also affects dnsmasq
• CVE-2026-12969 An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in… Also affects dnsmasq
• CVE-2026-4892 A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq… Also affects dnsmasq
• CVE-2026-4890 A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote… Also affects dnsmasq
• CVE-2026-4891 A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows… Also affects dnsmasq
• CVE-2026-4893 An information disclosure vulnerability in dnsmasq allows remote attackers to bypass… Also affects dnsmasq
• CVE-2026-5172 A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger… Also affects dnsmasq