EUVD-2026-38496
GHSA-g36w-q35r-qvg3
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Same-link IPv6 ND traffic so AV:A; no auth or user interaction; only availability of dhcpcd is impacted, hence C:N/I:N/A:H.
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.
AnalysisAI
Denial of service in dhcpcd through version 10.3.2 allows an adjacent-network attacker to exhaust memory in the daemon by repeatedly sending crafted IPv6 Router Advertisements with zero-lifetime Route Information options. The unfreed allocations in routeinfo_findalloc() accumulate linearly until the daemon crashes, disrupting DHCP client functionality on the affected host. No public exploit identified at time of analysis, but the upstream fix (commit 708b4a5) is available.
Technical ContextAI
dhcpcd is a widely used DHCP/DHCPv6 client daemon maintained by the NetworkConfiguration project, commonly bundled with Linux distributions, BSD systems, OpenWrt, and embedded networking devices for IPv4/IPv6 address autoconfiguration. The flaw lives in src/ipv6nd.c, specifically in the routeinfo_findalloc() helper used by IPv6 Neighbor Discovery (RFC 4861) and Route Information Option (RFC 4191) processing. CWE-401 (Missing Release of Memory after Effective Lifetime) applies: when a Router Advertisement carries a Route Information option with a lifetime of zero, the route info structure was allocated but never freed on the zero-lifetime path, so each crafted RA leaks a small allocation that accumulates without bound. The fix adds an explicit free(rinfo) in the expiration/cleanup path within ipv6nd_expirera().
RemediationAI
Upstream fix available (commit 708b4a56bae080a5b18c2e0c4c6fbe103131a2b0); a released patched version is not independently confirmed in the input, so administrators should upgrade dhcpcd to the next tagged release that includes this commit or apply the one-line patch (free(rinfo) in ipv6nd_expirera in src/ipv6nd.c) and rebuild. Track your distribution's security advisory channel for backported packages. Compensating controls if patching is delayed: enable RA Guard on managed switches to block rogue Router Advertisements from untrusted ports (most effective control, but requires switch support and correct port-trust configuration); on hosts that do not need IPv6 default-router autoconfiguration, disable IPv6 RA acceptance (e.g. sysctl net.ipv6.conf.all.accept_ra=0) which prevents the vulnerable code path but also disables legitimate IPv6 autoconfiguration; restrict dhcpcd to interfaces that face only trusted segments. Configure service supervision (systemd Restart=on-failure) so the daemon recovers automatically if exploited - this masks symptoms but does not address the leak. See https://github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0 for the authoritative patch.
dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-0
dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature. Rated c
dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses. Rated critical s
Stack out-of-bounds write in dhcpcd (the widely-used DHCP/DHCPv6 client) through version 10.3.2 lets a same-link attacke
Stack-based buffer overflow in the get_packet method in socket.c in dhcpcd 3.2.3 allows remote attackers to cause a deni
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related t
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bound
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bound
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP ser
The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.
The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products
Stack memory corruption in dhcpcd through 10.3.2 exposes systems running the DHCPv6 client to availability disruption fr
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Micro 6.2 | Affected |
| openSUSE Leap 16.0 | Affected |
| SLES-CHOST-BYOS-Aliyun | Affected |
| SLES-CHOST-BYOS-Azure | Affected |
| SLES-CHOST-BYOS-EC2 | Affected |
| SLES-CHOST-BYOS-GCE | Affected |
| SLES-CHOST-BYOS-GDC | Affected |
| SLES-CHOST-BYOS-SAP-CCloud | Affected |
Share
External POC / Exploit Code
Leaving vuln.today