The network XML schema supports typed DNS records using <dns><txt> and <dns><srv> tags, and the TXT and SRV domain/target values do not strip XML numeric char refs like (LF). As a result, these XML values can be used to insert additional configuration or commands into the dnsmasq config created by the network driver, e.g., a malicious dhcp-script=... line. libvirt socket access is already documented as root-equivalent, and raw <dnsmasq:options> namespace already exists, so this fix should be treated as hardening-only for default deployments that do not provide unpriv users with access to configure/extend these values. The series validates on both the parser and the emitter side: 1-2. reject LF/CR in the TXT value and SRV domain/target at XML parse time; 3. add a defensive check in the dnsmasq config emitter so a future parser gap cannot reintroduce directive injection; the raw <dnsmasq:options> namespace is intentionally left untouched; 4. add parse-path and update-API negative tests using / . Coordinated and assigned CVE-2026-61477 by RH team. Testing: built against current master with the network driver and tests enabled. The new negative tests fail on unpatched master (the expected parse error does not occur) and pass with the series applied, across both the network XML parse path and the update API. Michael Bommarito (4): conf: reject line breaks in DNS TXT record values conf: reject line breaks in DNS SRV domain and target network: reject line breaks before writing dnsmasq DNS config tests: cover line-break rejection in DNS TXT and SRV records src/conf/network_conf.c | 24 ++++++++++++++++ src/network/bridge_driver.c | 28 +++++++++++++++++++ .../dns-txt-record-newline.xml | 1 + .../srv-record-target-newline.xml | 1 + tests/networkxml2xmlupdatetest.c | 12 ++++++++ ...-network-dns-srv-record-domain-newline.xml | 14 ++++++++++ ...-network-dns-srv-record-target-newline.xml | 14 ++++++++++ .../nat-network-dns-txt-record-newline.xml | 14 ++++++++++ tests/networkxmlconftest.c | 3 ++ 9 files changed, 111 insertions(+) create mode 100644 tests/networkxml2xmlupdatein/dns-txt-record-newline.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-target-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml -- 2.53.0