CVE-2026-93008

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

CVSS 3.1

6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-345

Published

2026-10-29

Modified

2026-10-29

Record from

the NVD, synced 2026-10-29

References

• https://access.redhat.com/security/cve/CVE-2026-93008
• https://bugzilla.redhat.com/show_bug.cgi?id=2536079

Check your stackJSON