CVE-2020-25683: Debian Linux

Medium severity, CVSS 5.9. EPSS: 86% chance of exploitation in the next 30 days.

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Thekelleys Dnsmasq: before 2.83 (fixed in 2.83)

Published 2021-01-20. Last modified 2026-06-17.