Current version of dnsmasq has multiple CVEs
The current version of dnsmasq appears to have multiple CVEs written up against it (due to efforts from google’s security team).
See here for the list: https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html
(from redmine: issue id 8010, created on 2017-10-17, closed on 2019-05-03)