Multiple dnsmasq Vulnerabilities Patched in Amazon Linux 2023

AWS has released security advisory ALAS2023-2026-1729 for Amazon Linux 2023, detailing several critical vulnerabilities found in the `dnsmasq` package. These issues, including CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893, and CVE-2026-5172, pose significant security risks to affected systems. Specifically, CVE-2026-4890 describes a Denial of Service (DoS) vulnerability in `dnsmasq`'s DNSSEC validation, allowing remote attackers to trigger a DoS with a specially crafted DNS packet. CVE-2026-4891 is a heap-based out-of-bounds read, also leading to DoS via a crafted DNS packet. CVE-2026-4892 is a heap-based out-of-bounds write in the DHCPv6 implementation, potentially allowing local attackers to execute arbitrary code with root privileges. Furthermore, CVE-2026-4893 is an information disclosure vulnerability that could allow remote attackers to bypass source checks. To secure their systems, users should update `dnsmasq` by running `dnf update dnsmasq --releasever 2023.11.20260526` or `dnf update --advisory ALAS2023-2026-1729 --releasever 2023.11.20260526`.