Many router firmwares have dnsmasq for DNS but may never be upgraded? There are a number of other DNS servers which are not written in C, which support transpo

Many router firmwares have dnsmasq for DNS but may never be upgraded? There are a number of other DNS servers which are not written in C, which support transport-secured DNS like DoH (DNS-over-HTTP), DoT, and DoQ; but do they correctly handle this malformed input? From the mailing list disclosure, which doesn't yet have a CVE FWIU? https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2025q3/018288.html https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/20... : Dnsmasq forwards queries with special characters (e.g., ~, !, *, _) to upstream recursive resolvers. Some upstream recursive resolvers silently discard such malformed queries (no NXDomain/ServFail response). Dnsmasq does not validate or detect this situation, and waits silently, creating a large attack window. During this window, attackers can brute-force TxID (16-bit) and source port (16-bit) with a high probability of success (birthday paradox effect). Security Impact Attackers can poison any cached domain name in Dnsmasq. [...] We recommend adding: Detection mechanisms when upstream resolvers remain silent. Rate limiting and spoof-detection techniques, similar to those in PowerDNS > PowerDNS Mitigation: https://docs.powerdns.com/recursor/settings.html#spoof-nearmiss-max https://docs.powerdns.com/recursor/settings.html#spoof-nearm... spoof-nearmiss-max