🛡️ MGASA-2026-0288 — dnsmasq

Updated dnsmasq packages fix security vulnerabilities

The updated dnsmasq packages fix multiple security issues:

A heap-based buffer overflow was found in dnsmasq. When DNSSEC

validation and query logging are both enabled, logging of DS or DNSKEY

replies containing unsupported algorithm or digest types can cause

dnsmasq to write past the end of an internal logging buffer.

A remote attacker able to supply such a DNS response may crash the

dnsmasq process, resulting in denial of service. (CVE-2026-12725)

An out-of-bounds read vulnerability exists in dnsmasq's find_soa()

function in src/rfc1035.c. When parsing NS section records,

extract_name() is called with extrabytes=0, failing to validate that 10

additional bytes exist for fixed-length DNS record fields. A remote

attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN

response to cause a 10-byte heap out-of-bounds read, potentially

accessing stale data from prior transactions. (CVE-2026-12969)