CVE-2026-93007 in dnsmasq
Summary
by MITRE • 10/29/2026
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability in dnsmasq stems from an architectural limitation within its handling of Transmission Control Protocol (TCP) Domain Name System (DNS) traffic. Specifically, the service relies on a small, fixed pool of child processes to manage incoming TCP connections rather than dynamically scaling or implementing efficient connection state management mechanisms like timeouts for idle sessions. This design choice creates a resource exhaustion vector where an attacker can exploit the lack of receive timeout settings by opening numerous idle TCP connections to port 53 and maintaining them without sending any further data. By keeping these sockets open, the attacker effectively occupies every available slot in the child process pool. Since each connection consumes one worker from this limited pool, a sustained attack can exhaust all available resources dedicated to handling TCP DNS requests.
The operational impact of this flaw is significant for environments that rely on TCP-based DNS resolution or require robust security validation mechanisms. While User Datagram Protocol (UDP) DNS resolution continues to function normally because it operates independently of the TCP child process pool, the inability to accept new TCP connections disrupts critical network operations. Many modern DNS implementations and resolvers utilize TCP as a fallback mechanism when response packets exceed the size limit of UDP or when specific flags such as TC (Truncation) are set. Furthermore, DNS Security Extensions (DNSSEC), which provide cryptographic authentication of DNS data, often require TCP for validation processes that involve larger responses or zone transfers. Consequently, this vulnerability effectively blinds clients to secure and large-scale DNS queries, potentially leading to service degradation or complete failure in resolving domain names securely.
From a threat modeling perspective, this flaw aligns with CWE-400: Uncontrolled Resource Consumption, as the application fails to limit the resources consumed by an attacker-controlled input stream of connections. It also maps closely to MITRE ATT&CK technique T1498: Network Denial of Service, specifically under sub-techniques involving resource exhaustion through connection flooding. The attack does not require complex exploitation code or privilege escalation; it merely requires the ability to establish and maintain TCP sockets against the target port 53. This simplicity makes it a viable vector for distributed denial-of-service attacks targeting DNS infrastructure that utilizes dnsmasq as its resolver or caching server.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective mitigation is to upgrade dnsmasq to versions where this issue has been patched, typically by implementing receive timeouts on client connections so that idle sockets are automatically closed after a defined period of inactivity. Administrators should also consider configuring connection limits or rate limiting at the network perimeter using firewalls or intrusion prevention systems to restrict the number of concurrent TCP connections allowed from single source IPs. Additionally, monitoring tools can be deployed to detect abnormal patterns of open TCP connections on port 53, allowing for rapid identification and blocking of potential attackers before they exhaust the process pool. Ensuring that DNS infrastructure is not solely reliant on a small fixed pool of workers but instead utilizes more scalable concurrency models will further harden the service against such resource exhaustion attacks.