{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-12725-els_os-cloudlinux7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-25T22:16:07Z",
      "generator": {
        "date": "2026-10-25T22:16:07Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-12725-ELS_OS-CLOUDLINUX7ELS",
      "initial_release_date": "2026-06-22T16:16:00Z",
      "revision_history": [
        {
          "date": "2026-06-22T16:16:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-25T22:16:07Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-12725"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudLinux 7",
                "product": {
                  "name": "CloudLinux 7",
                  "product_id": "CloudLinux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "CloudLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.i686",
                "product": {
                  "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.i686",
                  "product_id": "dnsmasq-0:2.76-17.0.3.el7_9.99.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/dnsmasq@2.76-17.0.3.el7_9.99?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.i686",
                "product": {
                  "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.i686",
                  "product_id": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/dnsmasq-utils@2.76-17.0.3.el7_9.99?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.x86_64",
                "product": {
                  "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.x86_64",
                  "product_id": "dnsmasq-0:2.76-17.0.3.el7_9.99.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/dnsmasq@2.76-17.0.3.el7_9.99?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.x86_64",
                "product": {
                  "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.x86_64",
                  "product_id": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/dnsmasq-utils@2.76-17.0.3.el7_9.99?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                "product": {
                  "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                  "product_id": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/dnsmasq@2.76-17.0.3.el7_9.99.tuxcare.els5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                "product": {
                  "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                  "product_id": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/dnsmasq-utils@2.76-17.0.3.el7_9.99.tuxcare.els5?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                "product": {
                  "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                  "product_id": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/dnsmasq@2.76-17.0.3.el7_9.99.tuxcare.els5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                "product": {
                  "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                  "product_id": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/dnsmasq-utils@2.76-17.0.3.el7_9.99.tuxcare.els5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686"
        },
        "product_reference": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.i686"
        },
        "product_reference": "dnsmasq-0:2.76-17.0.3.el7_9.99.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64"
        },
        "product_reference": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.x86_64"
        },
        "product_reference": "dnsmasq-0:2.76-17.0.3.el7_9.99.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686"
        },
        "product_reference": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.i686"
        },
        "product_reference": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64"
        },
        "product_reference": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.x86_64"
        },
        "product_reference": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12725",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and\nquery logging are both enabled, logging of DS or DNSKEY replies containing\nunsupported algorithm or digest types can cause dnsmasq to write past the end\nof an internal logging buffer. A remote attacker able to supply such a DNS\nresponse may crash the dnsmasq process, resulting in denial of service.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.i686",
          "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
          "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
          "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.x86_64",
          "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.i686",
          "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
          "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
          "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-12725"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2026-12725",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12725"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2490763",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490763"
        }
      ],
      "release_date": "2026-06-22T16:16:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T12:46:13.902088Z",
          "details": "- Exploitation requires a non-default configuration: both DNSSEC validation and query logging must be enabled simultaneously; with defaults, the condition is not reachable.\n- Even then, an attacker must craft DS/DNSKEY replies with unsupported algorithms/digests (high attack complexity), and the outcome is limited to denial of service with no confidentiality or integrity impact.\n- Given these narrow preconditions and DoS-only effect, this issue can be safely deprioritized in managed enterprise server/VM environments.",
          "product_ids": [
            "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.i686",
            "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
            "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
            "CloudLinux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.x86_64",
            "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.i686",
            "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
            "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
            "CloudLinux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.x86_64"
          ]
        }
      ]
    }
  ]
}