VDB
ALPINE-CVE-2026-5172
ALPINE-CVE-2026-5172
PUBLISHED
CVSS 7.300000190734863 HIGH
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.
Risk Scores
CVSS 3.1
7.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.22 | dnsmasq | 2.86-r0, 0, 2.86-r0 |
| Alpine:v3.24 | dnsmasq | 0 |
| Alpine:v3.23 | dnsmasq | 0, 2.86-r0, 2.86-r1 |
Timeline
- May 11, 2026 CVE Published
- May 15, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated