Re: Questionable CVE's reported against dnsmasq

[Douglas Bagnall <douglas.bagnall () catalyst net nz>]

On 28/10/25 14:49, Solar Designer wrote:

> At this point, I think we want to hear from VulDB on this, and from
> MITRE on their requirements for CNAs in general and VulDB in particular
> to review CVE requests before assignment.  Maybe VulDB is in violation.

Samba has had at least one bogus CVE claim from a different CNA 
(mitre.org), but it is in some sort of "reserved" rather than "issued" 
state. That means that searching for the CVE number returns a single 
result -- the claimant's LinkedIn profile.

This would be the perfect outcome for all parties if we had not been 
required to spend hours confirming the report was bogus.

Alan Coopersmith wrote:
> The folks on the dnsmasq mailing list also pointed out the version claimed is
> a release candidate from 10 years ago, not anything current:

We also see this pattern.

Douglas