Dnsmasq 2026Q2 Six-CVE Cluster Intelligence

In May 2026, a cluster of six vulnerabilities (CVE-2026-2291 through CVE-2026-5172) was disclosed in dnsmasq, a widely deployed DNS and DHCP server found in Linux routers, Android devices, and cloud images. Five of the six bugs were identified by a single researcher, likely utilizing AI-assisted code auditing. The most critical vulnerabilities, CVE-2026-2291 and CVE-2026-4892, are heap out-of-bounds writes that could lead to remote code execution (RCE) in privileged contexts, including the DHCPv6 helper which runs as root.

The attack surface is substantial, ranging from local network clients to malicious upstream DNS providers. Several vulnerabilities, including those affecting DNSSEC (CVE-2026-4890 and CVE-2026-4891), are reachable before RRSIG validation occurs, meaning an attacker does not need a valid DNSSEC chain to trigger the bugs. Due to dnsmasq's extreme deployment footprint and the simplicity of some DoS primitives, opportunistic exploitation is expected to occur rapidly.

Immediate patching to dnsmasq 2.92rel2 is recommended. Organizations unable to patch immediately should consider disabling DNSSEC, DHCP scripts, and EDNS client-subnet features as temporary mitigations, although no configuration workaround exists for the core query/response parsing bugs.