Security Advisory catalog CVE-2026-93008 Historical advisory recorded 29 Oct 2026 14:12:12 UTC. Read the latest advisory .
cve-program · CVE-2026-93008 Published
A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-93008 Published rhceph/alloy-rhel10 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Ceph Storage 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhceph/alloy-rhel10",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:ceph_storage:9"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
} openshift4/ose-baremetal-runtimecfg-rhel8 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-baremetal-runtimecfg-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
} openshift4/ose-baremetal-runtimecfg-rhel9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-baremetal-runtimecfg-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
} openshift/ose-rhel-coreos-8 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
} openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 13 (Queens)",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openstack:13"
]
} rhoso-operators/infra-rhel9-operator https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 18.0",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoso-operators/infra-rhel9-operator",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
]
} Original source record · Cite this exact observation · Complete original publisher JSON