CVE-2026-4890

HighCVSS 7.5/10Last modified Aug 25, 2026

Description

A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 11, 2026
Last modified: Aug 25, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-489004.3An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.CVE-2026-489017.5The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.CVE-2026-489029.8The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.CVE-2026-489036.1Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.CVE-2026-489049.8An improper access check allows privelege escalation through the com_users group editing webservice endpoint.CVE-2026-489056.1Lack of input filtering leads to an XSS vector in the HTML filter code.CVE-2026-489068.1The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.CVE-2026-489079.8A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resu CVE-2026-489089.8A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and CVE-2026-489099.5SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote att CVE-2026-48915.3A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a CVE-2026-489106.5A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, whic