CVE-2026-4893

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 11, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-489309.8A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation i CVE-2026-489313.7A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This v CVE-2026-489323.7A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from CVE-2026-489337.5A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerabi CVE-2026-489344.3A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supporte CVE-2026-489353.3A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-rea CVE-2026-489363.3A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permissio CVE-2026-489377.5A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects CVE-2026-489399.8A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulti CVE-2026-48946.9A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multi CVE-2026-489403.4A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<scr CVE-2026-489416.5The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::de