diff --git a/dnsmasq-2.93-CVE-2026-2291.patch b/dnsmasq-2.93-CVE-2026-2291.patch
new file mode 100644
index 0000000..4e03909
--- /dev/null
+++ b/dnsmasq-2.93-CVE-2026-2291.patch
@@ -0,0 +1,36 @@
+From b8544d5802e56186eb144fbcdd18070b01dc9ab0 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Fri, 10 Apr 2026 16:29:31 +0100
+Subject: [PATCH 1/5] Fix buffer overflow in struct bigname. CVE-2026-2291
+
+All buffers capable of holding a domain name should be
+at least MAXDNAME*2 + 1 bytes long, where MAXDNAME is the maximum
+size of a domain name. The accounts for the trailing zero and the
+fact that some characters are escaped in the internal representation
+of a domain name in dnsmasq.
+
+The declaration of struct bigname get this wrong, with the effect
+that a remote attacker capable of asking DNS queries or answering DNS
+queries can cause a large OOB write in the heap.
+
+This was first spotted by Andrew S. Fasano.
+---
+ src/dnsmasq.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/dnsmasq.h b/src/dnsmasq.h
+index e455c3f..be8cf2a 100644
+--- a/src/dnsmasq.h
++++ b/src/dnsmasq.h
+@@ -467,7 +467,7 @@ struct interface_name {
+ };
+ 
+ union bigname {
+-  char name[MAXDNAME];
++  char name[(2*MAXDNAME) + 1];
+   union bigname *next; /* freelist */
+ };
+ 
+-- 
+2.54.0
+
diff --git a/dnsmasq.spec b/dnsmasq.spec
index 0efff33..659b50c 100644
--- a/dnsmasq.spec
+++ b/dnsmasq.spec
@@ -20,7 +20,7 @@
 
 Name:           dnsmasq
 Version:        2.85
-Release:        18%{?extraversion:.%{extraversion}}%{?dist}
+Release:        19%{?extraversion:.%{extraversion}}%{?dist}
 Summary:        A lightweight DHCP/caching DNS server
 
 License:        GPLv2 or GPLv3
@@ -79,6 +79,7 @@ Patch17:	dnsmasq-2.90-CVE-2023-50387-CVE-2023-50868.patch
 Patch18:        dnsmasq-2.87-filter-AAAA.patch
 # http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=5a9eae429a7d0680d606f03f2759d7dde0bbe3f0
 Patch19:        dnsmasq-2.89-filter-AAAA-improve.patch
+Patch20:        dnsmasq-2.93-CVE-2026-2291.patch
 
 # This is workaround to nettle bug #1549190
 # https://bugzilla.redhat.com/show_bug.cgi?id=1549190
@@ -226,6 +227,9 @@ install -Dpm 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/%{name}.conf
 %{_mandir}/man1/dhcp_*
 
 %changelog
+* Tue May 05 2026 Petr Menšík <pemensik@redhat.com> - 2.85-19
+- Prevent overflow in extract_name function (CVE-2026-2291)
+
 * Thu Dec 11 2025 Fedor Vorobev <fvorobev@redhat.com> - 2.85-18
 - Added installation of tmpfiles config.
 - Resolves: RHEL-135305