Description

A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-14T16:16:49.267Z",
  "pubdate": "2026-08-14T16:16:49.267Z",
  "executiveSummary": "A denial of service vulnerability has been identified within the dnsmasq service, specifically localized to the dnssec.c library. This flaw allows an unauthenticated remote attacker who controls any DNSSEC-signed zone to cause an infinite loop within the execution flow of the dnsmasq process.\nUpon successful exploitation using a single crafted DNS response, the affected dnsmasq daemon becomes entirely unresponsive, effectively halting all DNS resolution capabilities for connected clients depending on the service.\nThe vulnerability represents a severe availability risk for networks utilizing dnsmasq with DNSSEC validation enabled. The attacker capability requires control over a malicious or compromised DNSSEC zone, which triggers the parsing anomaly upon query resolution. No authentication or privileged access is required to initiate the attack vector beyond standard interaction with the victim resolver through malicious DNS responses.",
  "technicalDetails": "The vulnerability resides in the dnssec.c source file of the dnsmasq service, which handles the cryptographic verification and parsing of DNSSEC records. The root cause stems from improper bounds checking, state handling, or loop termination logic when processing maliciously crafted resource records within a DNSSEC-signed zone.\nWhen a client queries a domain within the attacker-controlled DNSSEC-signed zone, dnsmasq fetches the corresponding records and invokes the vulnerable parsing routines in dnssec.c. The crafted response contains specific structural anomalies designed to confound the record validation and iteration loops.\nStep-by-step, exploitation occurs as follows: First, the attacker configures a malicious DNSSEC-signed zone on an authoritative nameserver under their control. Second, the attacker induces a client or the resolver itself to issue a DNS query targeting this zone. Third, dnsmasq receives the recursive response and hands the payload to the dnssec.c library for validation. Fourth, the malformed structures cause the internal logic to enter an unrecoverable infinite loop, consuming 100 percent of a CPU core and freezing the single-threaded event loop.\nBecause dnsmasq becomes entrapped in this computational cycle, it fails to process any subsequent incoming DNS queries for any domain, leading to a complete denial of service condition for all downstream clients relying on the resolver instance. Network exposure is broad, affecting any deployment where dnsmasq performs DNSSEC validation and processes untrusted external DNS traffic."
}