Skip to main content

ISC DHCP Server CVE-2026-18103

| EUVDEUVD-2026-52999 MEDIUM
Classic Buffer Overflow (CWE-120)
2026-08-04 redhat GHSA-wq4j-5vp3-jcrx
Buffer Overflow Denial Of Service Red Hat Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Suse Red Hat
4.9
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
4.9 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Without TSIG, OMAPI accepts unauthenticated connections making PR:N the realistic worst-case; confidentiality and integrity are unaffected by a pure crash DoS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.9 LOW
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 05, 2026 - 01:52 vuln.today
CVE Published
Aug 04, 2026 - 23:08 nvd
MEDIUM 4.9

DescriptionCVE.org

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the print_hw_addr() function. Successful exploitation leads to a persistent denial of service (DoS), causing the dhcpd service to crash and preventing it from restarting without manual intervention.

AnalysisAI

Persistent denial of service in dhcp-server (dhcpd) on Red Hat Enterprise Linux 6 through 9 is triggered via a crafted OMAPI lease creation request containing an overly long InfiniBand MAC address, overflowing a buffer in print_hw_addr() and crashing the dhcpd daemon in a way that prevents automatic recovery. The official CVSS score of 4.9 with PR:H reflects the assumption that TSIG authentication guards the OMAPI port; however, the description explicitly highlights that TSIG is optional and often absent, reducing the realistic exploitation barrier to unauthenticated network access. No confirmed active exploitation (KEV) or public proof-of-concept exists at time of analysis.

Technical ContextAI

The ISC DHCP daemon (dhcpd), shipped as the dhcp-server package in RHEL 6 through 9, exposes an OMAPI (Open Management Application Programming Interface) management port - typically TCP 7911 - for runtime administration of leases, pools, and host entries. OMAPI optionally enforces TSIG (Transaction Signature) key-based HMAC authentication, but this is a non-default configuration requiring explicit operator setup. The print_hw_addr() function processes hardware address strings when logging or displaying lease information; it performs no length validation before copying caller-supplied InfiniBand MAC address data into a statically-sized buffer, representing a classic CWE-120 (Buffer Copy without Checking Size of Input) defect. InfiniBand interface identifiers (IPoIB) are substantially longer than standard Ethernet MACs, providing an attacker a reliable overflow primitive. Affected CPEs confirmed by Red Hat span cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through _9, covering all actively supported RHEL major releases.

RemediationAI

Apply the Red Hat-released patch for the dhcp-server package via standard package management (dnf update dhcp-server or yum update dhcp-server) as soon as the fix is published to the relevant RHEL channel; monitor https://access.redhat.com/security/cve/CVE-2026-18103 and https://bugzilla.redhat.com/show_bug.cgi?id=2508081 for exact patched package version confirmation, as a specific fix version has not been independently confirmed in available intelligence. As an immediate and highly effective compensating control, restrict access to the OMAPI port (default TCP 7911) using host-based or network firewall rules to allow connections only from trusted management hosts - this eliminates the remote attack surface entirely without impacting DHCP client service. Additionally, configure TSIG key authentication for OMAPI in dhcpd.conf as documented in the dhcpd.conf(5) man page; this requires authenticated clients even before any patch is applied, though it does not eliminate the underlying buffer overflow and must be treated as a mitigation rather than a fix. Implement service monitoring on dhcpd process health so that if exploitation occurs and the daemon crashes, automated alerting reduces manual recovery time.

More in Red Hat Enterprise Linux 6

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-59090 CRITICAL
9.9 Aug 10

Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-18103 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy