Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
Summary: Palo Alto Networks Unit 42 details recently discovered dnsmasq vulnerabilities that enable DNS cache poisoning, denial of service, and possibly remote code execution in a resolver used from Kubernetes to routers. Because dnsmasq does not match transaction IDs to specific source ports and holds up to 150 forward records across 64 ports, the flaws CVE-2020-25684, CVE-2020-25685, and CVE-2020-25686 combine to raise an attacker's odds of hitting an open request by 9,600 times.
What you should know: That 9,600-fold increase cuts the guessing space from a 32-bit key to roughly 1 in 447,392 per response, and dnsmasq's trust of unverified CNAME responses lets an attacker overwrite an already-cached bank address without waiting for its TTL to expire.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026