Medium severity · published Oct 29, 2026
CVE-2026-93007
Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
New
5.3
CVSS
–
EPSS
No
On KEV
Description
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Ceph Storage 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenStack Platform 13 (Queens) · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenStack Platform 18.0 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93007
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-93007
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2536076
More from Red Hat Ceph Storage 9
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
9.8
CVE-2026-41242
protobufjs has an arbitrary code execution issue
9.8
CVE-2026-27459
pyOpenSSL DTLS cookie callback buffer overflow
9.1
CVE-2026-39830
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
9.1
CVE-2026-39832
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent