Hi,

The following vulnerability was published for dnsmasq.

Unfortunately at time of writing this bugreport only the Red Hat
bugzilla entry [1] was available. Can you check?

CVE-2026-13002[0]:
| A flow has been identified into dnssec.c library, causing an
| infinite loop to dnsmasq service. An attacker who controls any
| DNSSEC-signed zone can hang the dnsmasq process with a single
| crafted response, killing all DNS resolution for its clients.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-13002
https://www.cve.org/CVERecord?id=CVE-2026-13002
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2486360

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hi Simon,

do you know what might be causing the issue reported in the message
quoted above? Unfortunately the bugreport at Red Hat is quite sparse.

In case you have a patch available, I am happy to prepare uploads to
unstable and trixie.

Best,
Sven