Skip to content
Fencer Vulns
high 7.5

CVE-2023-28450 json

An issue was discovered in Dnsmasq before 2.90.

published 2023-03-15 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-32132

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.

Patch / fix

  • thekelleys dnsmasq 2.90
  • dnsmasq Debian 12 2.90-4~deb12u1
  • dnsmasq Debian 14, Debian 13 2.90-1

debian advisories DEBIAN-CVE-2023-28450

  • dnsmasq Ubuntu 18.04 LTS 2.79-1ubuntu0.7
  • dnsmasq Ubuntu 20.04 LTS 2.80-1.1ubuntu1.7
  • dnsmasq Ubuntu 22.04 LTS 2.86-1.1ubuntu0.3
  • dnsmasq Ubuntu Pro 14.04 LTS 2.68-1ubuntu0.2+esm2
  • dnsmasq Ubuntu Pro 16.04 LTS 2.79-1ubuntu0.16.04.1+esm2

ubuntu advisories UBUNTU-CVE-2023-28450

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dnsmasq RHEL 8 2.79-31.el8
  • dnsmasq-utils RHEL 8 2.79-31.el8
  • dnsmasq RHEL 9 2.85-14.el9
  • dnsmasq-utils RHEL 9 2.85-14.el9
  • dnsmasq RHEL 8.6 EUS 2.79-21.el8_6.5
  • dnsmasq-utils RHEL 8.6 EUS 2.79-21.el8_6.5
  • dnsmasq RHEL 8.8 EUS 2.79-26.el8_8.4
  • dnsmasq-utils RHEL 8.8 EUS 2.79-26.el8_8.4

red hat advisories RHSA-2024:1545RHSA-2024:1544RHSA-2024:4052RHSA-2023:7046RHSA-2023:6524

  • dnsmasq Linux Micro 6.0 2.90-1.1
  • dnsmasq SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +13 more 2.90-150400.16.3.1
  • dnsmasq SLES for SAP 12 SP5, SLES 12 SP5, OpenStack Cloud Crowbar 9 +4 more 2.78-18.21.1
  • dnsmasq SLE Real Time 15 SP3, SLE Micro 5.2, SLE Micro 5.1 2.86-150100.7.23.1

suse advisories SUSE-SU-2025:20118-1SUSE-SU-2025:0071-1SUSE-SU-2023:2123-1SUSE-SU-2023:1930-1

  • dnsmasq openSUSE Tumbleweed 2.89-3.1

opensuse advisories openSUSE-SU-2024:12887-1

  • dnsmasq AlmaLinux 8 2.79-31.el8
  • dnsmasq-utils AlmaLinux 8 2.79-31.el8
  • dnsmasq AlmaLinux 9 2.85-14.el9
  • dnsmasq-utils AlmaLinux 9 2.85-14.el9

almalinux advisories ALSA-2023:7046ALSA-2023:6524

  • dnsmasq Alpine 3.14 2.86-r3
  • dnsmasq Alpine 3.15 2.86-r2
  • dnsmasq Alpine 3.16 2.86-r4
  • dnsmasq Alpine 3.17 2.87-r2
  • dnsmasq Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 2.89-r3

alpine advisories ALPINE-CVE-2023-28450

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dnsmasq CBL-Mariner 2.0 2.89-2

azure linux advisories AZL-25660

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-28450 updated cvss 7.5

dnsmasq: default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232

  • Red Hat Enterprise Linux 6 dnsmasq, dnsmasq-utils Red Hat Enterprise Linux 7 dnsmasq, dnsmasq-utils Red Hat OpenStack Platform 13 (Queens) dnsmasq-utils
    affected: workaround, no fix planned “Systems that can not be updated can still configure dnsmasq to use the recommended maximum EDNS value by setting edns-packet-max=1232 in the dnsmasq configuration.”
  • Red Hat Enterprise Linux AppStream (v. 8) dnsmasq 2.79-31.el8, dnsmasq-utils 2.79-31.el8
    fixed: vendor fix “Systems that can not be updated can still configure dnsmasq to use the recommended maximum EDNS value by setting edns-packet-max=1232 in the dnsmasq configuration.” RHSA-2023:7046
  • Red Hat Enterprise Linux AppStream (v. 9) dnsmasq 2.85-14.el9, dnsmasq-utils 2.85-14.el9
    fixed: vendor fix “Systems that can not be updated can still configure dnsmasq to use the recommended maximum EDNS value by setting edns-packet-max=1232 in the dnsmasq configuration.” RHSA-2023:6524
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) dnsmasq 2.79-21.el8_6.5, dnsmasq-utils 2.79-21.el8_6.5
    fixed: vendor fix “Systems that can not be updated can still configure dnsmasq to use the recommended maximum EDNS value by setting edns-packet-max=1232 in the dnsmasq configuration.” RHSA-2024:1545
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) dnsmasq 2.79-26.el8_8.4, dnsmasq-utils 2.79-26.el8_8.4
    fixed: vendor fix “Systems that can not be updated can still configure dnsmasq to use the recommended maximum EDNS value by setting edns-packet-max=1232 in the dnsmasq configuration.” RHSA-2024:1544
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) dnsmasq 2.85-6.el9_2.4, dnsmasq-utils 2.85-6.el9_2.4
    fixed: vendor fix “Systems that can not be updated can still configure dnsmasq to use the recommended maximum EDNS value by setting edns-packet-max=1232 in the dnsmasq configuration.” RHSA-2024:4052

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-319-06 updated cvss 7.5

Siemens SCALANCE M-800 Family

  • Siemens RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) <V8.2 Siemens RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) <V8.2 Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) <V8.2 Siemens SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) <V8.2 Siemens SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) <V8.2 Siemens SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) <V8.2
    +20 more products
    Siemens SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) <V8.2 Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) <V8.2 Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) <V8.2 Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2) <V8.2 Siemens SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) <V8.2 Siemens SCALANCE M876-3 (6GK5876-3AA02-2BA2) <V8.2 Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) <V8.2 Siemens SCALANCE M876-4 (6GK5876-4AA10-2BA2) <V8.2 Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) <V8.2 Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) <V8.2 Siemens SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) <V8.2 Siemens SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) <V8.2 Siemens SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) <V8.2 Siemens SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) <V8.2 Siemens SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) <V8.2 Siemens SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) <V8.2 Siemens SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) <V8.2 Siemens SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) <V8.2 Siemens SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) <V8.2 Siemens SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) <V8.2
    affected: fixed in V8.2 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-046-11 updated cvss 7.5

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

1.84% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.