Riskcovery

CVE-2026-93007

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

State
Published
Severity
5.3 Medium
Published
Oct 29, 2026
Updated
Oct 30, 2026
Reserved
Sep 17, 2026

Read the record on cve.org

Description

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lredhat

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
Red Hat Ceph Storage 9Red Hat
    Red Hat Enterprise Linux 10Red Hat
      Red Hat Enterprise Linux 6Red Hat
        Red Hat Enterprise Linux 7Red Hat
          Red Hat Enterprise Linux 8Red Hat
            Red Hat Enterprise Linux 9Red Hat
              Red Hat OpenShift Container Platform 4Red Hat
                Red Hat OpenShift Container Platform 4Red Hat
                  Red Hat OpenShift Container Platform 4Red Hat
                    Red Hat OpenShift Container Platform 4Red Hat
                      Red Hat OpenShift Container Platform 5Red Hat
                        Red Hat OpenShift Container Platform 5Red Hat
                          Red Hat OpenStack Platform 13 (Queens)Red Hat
                            Red Hat OpenStack Platform 18.0Red Hat

                              References

                              Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.