Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-5172

Fixed in a distro release EPSS 3%CVSS 7.3

A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.

Published 2026-05-11 · CVE record · OSV

Products: dnsmasq, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4

Distro releases

ReleasePackageFixed in
AlmaLinux 10dnsmasq2.90-7.el10_2
AlmaLinux 10dnsmasq-utils2.90-7.el10_2
Alpine 3.22dnsmasq2.91-r1
Alpine 3.23dnsmasq2.91-r1
Alpine 3.24dnsmasq2.92_p2-r0
Amazon Linux 2023dnsmasq2.90-1.amzn2023.0.3
Amazon Linux 2023dnsmasq-utils2.90-1.amzn2023.0.3
Chainguarddnsmasq2.93-r0
Chainguarddnsmasq-doc2.93-r0
Debian 12dnsmasq2.90-4~deb12u2
Debian 13dnsmasq2.91-1+deb13u1
Debian 14dnsmasq2.92-5
Red Hat Enterprise Linux 10.2dnsmasq0:2.90-7.el10_2
Red Hat Enterprise Linux 10.2dnsmasq-debuginfo0:2.90-7.el10_2
Red Hat Enterprise Linux 10.2dnsmasq-debugsource0:2.90-7.el10_2
Red Hat Enterprise Linux 10.2dnsmasq-utils0:2.90-7.el10_2
Red Hat Enterprise Linux 10.2dnsmasq-utils-debuginfo0:2.90-7.el10_2
Rocky Linux 10dnsmasq0:2.90-7.el10_2
SUSE Linux Enterprise Server 12 SP5-LTSSdnsmasq2.92rel2-18.27.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5dnsmasq2.92rel2-18.27.1
Ubuntu 22.04 LTSdnsmasq2.90-0ubuntu0.22.04.3
Ubuntu 24.04 LTSdnsmasq2.90-2ubuntu0.3
Ubuntu 25.10dnsmasq2.91-1ubuntu0.2
Ubuntu 26.04 LTSdnsmasq2.92-1ubuntu0.2
Ubuntu Pro 14.04 LTSdnsmasq2.68-1ubuntu0.2+esm5
Ubuntu Pro 16.04 LTSdnsmasq2.90-0ubuntu0.16.04.1+esm3
Ubuntu Pro 18.04 LTSdnsmasq2.90-0ubuntu0.18.04.1+esm3
Ubuntu Pro 20.04 LTSdnsmasq2.90-0ubuntu0.20.04.1+esm2
Wolfidnsmasq2.93-r0
Wolfidnsmasq-doc2.93-r0
openSUSE Tumbleweeddnsmasq2.92rel2-1.1