Vulnerability in dnsmasq DHCPv6 Client Hostname Parser
CVE-2026-93009

4.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ceph Storage 9
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Vendor
CVE Published:
29 October 2026

What is CVE-2026-93009?

A vulnerability exists in the dnsmasq DHCPv6 client hostname parser, where the parser can improperly read memory just past the end of a crafted Fully Qualified Domain Name (FQDN) option. This occurs because the parser checks the length of the next label before confirming that the pointer remains within the bounds of the option. An attacker with access to the local network can exploit this flaw by sending a carefully crafted DHCPv6 packet. While the excess byte is not logged or returned to the client, the potential for disruption poses a risk that requires attention.

References

https://access.redhat.com/security/cve/CVE-2026-93009
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536083
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.
.