---
id: CVE-2026-12725
title: A heap-based buffer overflow was found in dnsmasq
summary: |-
  A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and
  query logging are both enabled, logging of DS or DNSKEY replies containing
  unsupported algorithm or digest types can cause dnsmasq to write past the end
  of an …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-122
vendor: redhat
product: openshift_container_platform
affected:
  - 'openshift_container_platform >= 4.0, <= 4.22.1'
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
  - enterprise_linux = 10.0
  - dnsmasq < 2.93
patched:
  - dnsmasq 2.93
published: '2026-06-22'
updated: '2026-08-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12725'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-12725'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2490763'
    label: secalert@redhat.com
tags:
  - nvd
epss: 0.00528
epssPercentile: 0.42258
ingestedAt: '2026-08-24T11:02:09.113Z'
---

## Overview

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and
query logging are both enabled, logging of DS or DNSKEY replies containing
unsupported algorithm or digest types can cause dnsmasq to write past the end
of an internal logging buffer. A remote attacker able to supply such a DNS
response may crash the dnsmasq process, resulting in denial of service.

## Affected

- `openshift_container_platform >= 4.0, <= 4.22.1`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`
- `enterprise_linux = 10.0`
- `dnsmasq < 2.93`

## Remediation

Upgrade past the affected range:

- `dnsmasq 2.93`