ALAS2027-2026-089

References: CVE-2026-13002  CVE-2026-4890  CVE-2026-4891  CVE-2026-4892  CVE-2026-4893  CVE-2026-5172  CVE-2026-6507 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients. (CVE-2026-13002)

A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet. (CVE-2026-4890)

A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet. (CVE-2026-4891)

A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet. (CVE-2026-4892)

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information. (CVE-2026-4893)

A buffer overflow in dnsmasq's extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record's end. (CVE-2026-5172)

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the `--dhcp-split-relay` option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS). (CVE-2026-6507)

Issue Correction:
Run yum update dnsmasq to update your system.

New Packages:

aarch64:
    dnsmasq-debugsource-2.93-2.amzn2027.aarch64
    dnsmasq-utils-debuginfo-2.93-2.amzn2027.aarch64
    dnsmasq-debuginfo-2.93-2.amzn2027.aarch64
    dnsmasq-utils-2.93-2.amzn2027.aarch64
    dnsmasq-2.93-2.amzn2027.aarch64

noarch:
    dnsmasq-langpack-2.93-2.amzn2027.noarch

src:
    dnsmasq-2.93-2.amzn2027.src

x86_64:
    dnsmasq-debugsource-2.93-2.amzn2027.x86_64
    dnsmasq-debuginfo-2.93-2.amzn2027.x86_64
    dnsmasq-utils-debuginfo-2.93-2.amzn2027.x86_64
    dnsmasq-utils-2.93-2.amzn2027.x86_64
    dnsmasq-2.93-2.amzn2027.x86_64