Dnsmasq Vulnerabilities Expose Networks to DoS and Data Leaks
Critical flaws in Dnsmasq allow remote attackers to crash services or access sensitive data. Organizations using Ubuntu should update immediately.
TL;DR
- Two high-severity vulnerabilities found in Dnsmasq DNS forwarder
- CVE-2026-12725 allows denial-of-service via malformed DNS records
- CVE-2026-12969 may expose memory contents through buffer over-reads
- Affects Ubuntu systems running Dnsmasq for DNS caching or DHCP
- Immediate patching recommended; updates available for all supported releases
Ubuntu has issued a high-priority security advisory addressing two dangerous vulnerabilities in Dnsmasq, a widely used lightweight DNS forwarder. These issues affect organizations relying on Dnsmasq for internal DNS resolution, including many Kubernetes clusters and embedded systems.
The more severe flaw enables remote attackers to trigger denial-of-service conditions by sending specially crafted DNS queries. The second vulnerability involves improper validation of DNS record lengths, which could lead to unauthorized disclosure of system memory contents containing sensitive information.
Organizations using Ubuntu distributions should prioritize applying the provided patches across their infrastructure to prevent potential exploitation of these network-exposed vulnerabilities.
Attack Scenarios and Impact
- Remote unauthenticated attackers can exploit both vulnerabilities without prior access
- Denial-of-service impacts availability of DNS-dependent services and applications
- Memory disclosure could expose cached DNS entries, configuration details, or adjacent memory structures
- Kubernetes clusters using Dnsmasq for pod DNS resolution are particularly exposed
- Embedded devices and routers running Dnsmasq may lack easy patch deployment mechanisms
Remediation Steps
- Apply updated Dnsmasq packages immediately through standard Ubuntu update procedures
- Verify patch deployment across all affected Ubuntu versions: 24.04, 22.04, 20.04, and 18.04 LTS
- Monitor DNS service logs for signs of exploitation attempts or unusual query patterns
- Consider temporarily disabling non-critical DNS forwarding during patch maintenance windows
- Audit network architectures to identify all Dnsmasq instances, including containerized deployments
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.