CVE-2023-49441 is a high severity integer overflow, scored 7.5, in dnsmasq, reached through forward_query. The record names version 2.9 and a denial of service impact. It gives no fixed release, so check your distribution's package advisory, and look for dnsmasq copies inside container images and device firmware.
What's affected
The record says dnsmasq 2.9 is vulnerable to an integer overflow via forward_query. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which means a network reachable availability impact with no privileges.
The record has two references: a message on the dnsmasq mailing list and a commit in the project's repository. The mailing list message, which I read, is a report of a runtime undefined behaviour error. It shows a left shift in the SHA-256 code of the hash questions function, reached through forward_query. It gives no version number beyond the latest version. The post therefore cannot confirm which release contains the fix. I did not read the commit, so check the project's changelog and your distribution.
How to check if you're exposed
Read your installed version first.
dnsmasq --version
On Debian or Ubuntu, you can also check the package version.
dpkg -l dnsmasq dnsmasq-base
The record names version 2.9, so confirm the exact version string your distribution uses. Then check your distribution's security tracker for CVE-2023-49441, because distributions often backport fixes without changing the version number.
Container images and router firmware often embed dnsmasq. A scan of your images and firmware inventory is the reliable way to find those copies.
What to do now
- Run the version check on every host that serves DNS or DHCP with dnsmasq.
- Check your distribution's tracker for CVE-2023-49441 and apply its package update if one exists.
- Scan container images and appliance firmware for embedded dnsmasq, since those copies do not update with your host packages.
- Limit who can send queries to the resolver, for example by binding it to internal interfaces only.
- Monitor the service for crashes and restarts, since the impact is availability.
Why it matters
The weakness is integer overflow or wraparound, CWE-190. An arithmetic result no longer fits in the type that holds it, and later code assumes it still does.
The interesting detail is the gap between the record and the primary source. The record calls it an integer overflow via forward_query, while the mailing list report describes undefined behaviour in a hashing step called from forward_query. Those can both be true of the same code path, but it is a reason to follow your distribution's assessment of impact. KEV status is false for this CVE.
dnsmasq is everywhere: home routers, container hosts and lab networks. That reach is why a modest 7.5 deserves attention in a software inventory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is version 2.9 the same as 2.90?
This post cannot say. The record names 2.9, so confirm the exact string with your distribution and its security tracker.
Sources
dnsmasq-discuss mailing list message, 2023 Q4
Last reviewed: 19 October 2026.
