CVE-2026-93008

The record

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

Affected packages

Related vulnerabilities

• CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-345
• CVE-2026-119289 Zuke is a code-first, strongly typed build automation system for Deno. CWE-345
• CVE-2026-119422 Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that… CWE-345
• CVE-2026-110985 A Kafka broker using SASL/OAUTHBEARER with the default validator… CWE-345
• CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled… CWE-345
• CVE-2026-103402 An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper… CWE-345
• CVE-2026-103330 The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the… CWE-345
• CVE-2026-103313 The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the… CWE-345