Skip to content
Fencer Vulns
high 8.1

CVE-2020-25681 in the critical feed json

A flaw was found in dnsmasq before version 2.83.

published 2021-01-20 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-18343

cvss
8.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
84.1%
EPSS 84.1% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known

Summary

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Patch / fix

  • thekelleys dnsmasq 2.83
  • dnsmasq Debian 14, Debian 13, Debian 12 2.83-1

debian advisories DEBIAN-CVE-2020-25681

  • dnsmasq Ubuntu 16.04 LTS 2.75-1ubuntu0.16.04.7
  • dnsmasq Ubuntu 18.04 LTS 2.79-1ubuntu0.2
  • dnsmasq Ubuntu 20.04 LTS 2.80-1.1ubuntu1.2

ubuntu advisories UBUNTU-CVE-2020-25681

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dnsmasq RHEL 8 2.79-13.el8_3.1
  • dnsmasq-utils RHEL 8 2.79-13.el8_3.1
  • dnsmasq RHEL 8.1 EUS 2.79-6.el8_1.1
  • dnsmasq-utils RHEL 8.1 EUS 2.79-6.el8_1.1
  • dnsmasq RHEL 8.2 EUS 2.79-11.el8_2.2
  • dnsmasq-utils RHEL 8.2 EUS 2.79-11.el8_2.2

red hat advisories RHSA-2021:0150RHSA-2021:0152RHSA-2021:0151

  • dnsmasq SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +14 more 2.78-18.15.1
  • dnsmasq SLE Point of Sale 11 SP3 2.78-0.16.14.1
  • dnsmasq SLE Module for Basesystem 15 SP2, SLE Module for Basesystem 15 SP1 2.78-7.6.1
  • dnsmasq SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 2.78-3.11.1
  • dnsmasq SLES 11 SP4-LTSS 2.78-0.17.15.1

suse advisories SUSE-SU-2021:0166-1SUSE-SU-2021:14604-1SUSE-SU-2021:14603-1SUSE-SU-2021:0163-1SUSE-SU-2021:0162-1

  • dnsmasq openSUSE Tumbleweed 2.86-1.1
  • dnsmasq openSUSE Leap 15.1 2.78-lp151.5.6.1
  • dnsmasq openSUSE Leap 15.2 2.78-lp152.7.3.1

opensuse advisories openSUSE-SU-2024:10721-1openSUSE-SU-2021:0129-1openSUSE-SU-2021:0124-1

  • dnsmasq Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 2.83-r0

alpine advisories ALPINE-CVE-2020-25681

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dnsmasq Arch Linux 2.83-1

arch linux advisories AVG-1470

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-25681 updated cvss 8.1

dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled

  • Red Hat Enterprise Linux AppStream (v. 8) dnsmasq 2.79-13.el8_3.1, dnsmasq-utils 2.79-13.el8_3.1
    fixed: vendor fix “The only known way to mitigate this flaw is to disable DNSSEC altogether, by removing the `--dnssec` command line option or the `dnssec` option from dnsmasq configuration file.” RHSA-2021:0150
  • Red Hat Enterprise Linux AppStream EUS (v. 8.1) dnsmasq 2.79-6.el8_1.1, dnsmasq-utils 2.79-6.el8_1.1
    fixed: vendor fix “The only known way to mitigate this flaw is to disable DNSSEC altogether, by removing the `--dnssec` command line option or the `dnssec` option from dnsmasq configuration file.” RHSA-2021:0152
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) dnsmasq 2.79-11.el8_2.2, dnsmasq-utils 2.79-11.el8_2.2
    fixed: vendor fix “The only known way to mitigate this flaw is to disable DNSSEC altogether, by removing the `--dnssec` command line option or the `dnssec` option from dnsmasq configuration file.” RHSA-2021:0151
  • Red Hat Enterprise Linux 5 dnsmasq Red Hat Enterprise Linux 6 dnsmasq, dnsmasq-utils Red Hat Enterprise Linux 7 dnsmasq, dnsmasq-utils Red Hat Enterprise Linux 9 dnsmasq, dnsmasq-utils Red Hat OpenStack Platform 10 (Newton) dnsmasq-utils Red Hat OpenStack Platform 13 (Queens) dnsmasq-utils
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

84.08% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 8.3 AV:N/AC:M/Au:N/C:P/I:P/A:C

Affected products

  • n/a dnsmasq

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.