« Volver al listado

CVE-2026-4893

Estado: Pendiente de análisisMedia (5.3)—

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Dnsmasq — DnsmasqAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-4893",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-4893",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-11T18:28:57.486938Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "dnsmasq",
          "product": "dnsmasq",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.92rel2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-11T18:16:41.593",
  "references": [
    {
      "url": "https://github.com/NixOS/nixpkgs/pull/519082",
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/NixOS/nixpkgs/pull/519093",
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/pi-hole/FTL/releases/tag/v6.6.2",
      "source": "cret@cert.org"
    },
    {
      "url": "https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html",
      "source": "cret@cert.org"
    },
    {
      "url": "https://thekelleys.org.uk/dnsmasq/CVE/",
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/471747",
      "source": "cret@cert.org"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information."
    }
  ],
  "lastModified": "2026-06-17T10:57:24.507",
  "sourceIdentifier": "cret@cert.org"
}