Vulnerability record · CVE-2017-14495 · published 3 October 2017
CVE-2017-14495: dnsmasq memory leak in DNS response creation causes denial of service
Canonical · Ubuntu Linux
dnsmasq before 2.78 leaks memory when the --add-mac, --add-cpe-id or --add-subnet option is enabled, and DNS response creation triggers the leak. Repeated queries steadily consume memory until the resolver or DHCP service is exhausted, so it matters for any deployment running those options on an internet-reachable or client-facing instance.
Description
Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityNetwork-reachable, unauthenticated denial of service with a very high EPSS score and public exploit code, though limited to instances using the affected options.
What it is
dnsmasq before 2.78 leaks memory when the --add-mac, --add-cpe-id or --add-subnet option is enabled, and DNS response creation triggers the leak. Repeated queries steadily consume memory until the resolver or DHCP service is exhausted, so it matters for any deployment running those options on an internet-reachable or client-facing instance.
Impact
A remote attacker can drive unbounded memory consumption and cause a denial of service, taking down DNS and DHCP service for all clients relying on the affected dnsmasq instance.
Attack surface
Reachable over the network via DNS traffic with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. It only applies where one of the three affected options is configured.
Exploitation
Not listed in CISA KEV, but EPSS is very high at 0.843 (99.7th percentile) and a public Exploit-DB entry (42945) exists, indicating mature public exploitation.
What to do
- Upgrade dnsmasq to 2.78 or later, or apply the vendor patch for your distribution (Red Hat RHSA-2017:2836, Debian DSA-3989, Ubuntu USN-3430-1/2).
- If patching is delayed, remove or disable the --add-mac, --add-cpe-id and --add-subnet options where they are not strictly required.
- Restrict DNS and DHCP exposure to trusted networks and block external access to the resolver port.
- Monitor dnsmasq process memory and restart on abnormal growth as a stopgap.
- Track vendor advisories for embedded or appliance builds (Aruba, Siemens, Synology, NVIDIA) that bundle dnsmasq.
Detection
- Monitor dnsmasq process RSS over time for steady growth without corresponding query volume increases.
- Alert on OOM-killer events or service restarts affecting dnsmasq.
- Baseline DNS query rates per source and flag sustained high-volume response generation from single sources.
- Check configuration management data for hosts still running the affected options on unpatched dnsmasq versions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-14495 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-14495), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
