Vulnerability record · CVE-2026-4890 · published 11 May 2026

CVE-2026-4890: A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a…

A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

7.5 CVSS 3.1 High EPSS 1.1% · top 36.6% CWE-835 · CWE-835 Awaiting Analysis

7.5CVSS 3.1 base score

1.1%EPSS exploitation probability, 30 days

NoNot in CISA KEV

0Affected product versions listed by NVD

14References

25 Aug 2026Last modified by NVD

Description

A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Link	Tags
https://github.com/NixOS/nixpkgs/pull/519082
https://github.com/NixOS/nixpkgs/pull/519093
https://github.com/pi-hole/FTL/releases/tag/v6.6.2
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html
https://thekelleys.org.uk/dnsmasq/CVE/
https://www.kb.cert.org/vuls/id/471747
https://access.redhat.com/errata/RHSA-2026:19158
https://access.redhat.com/errata/RHSA-2026:19373
https://access.redhat.com/errata/RHSA-2026:20589
https://access.redhat.com/errata/RHSA-2026:34508
https://access.redhat.com/errata/RHSA-2026:40762
https://access.redhat.com/security/cve/CVE-2026-4890
https://bugzilla.redhat.com/show_bug.cgi?id=2458516
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4890.json

Track CVE-2026-4890 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2024-20353Cisco ASA and FTD web server HTTP header parsing DoSCisco ASA and FTD management and VPN web servers fail to fully check errors when parsing an HTTP header, so a crafted request can crash and reload th…KEVEPSS 71%analysed24 Apr 2024

Source: NIST National Vulnerability Database (record CVE-2026-4890), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.