EUVD-2026-23996Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
4DescriptionCVE.org
In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero.
AnalysisAI
Denial-of-service in OpenBSD slaacd and rad daemons allows local network attackers to trigger infinite loops by sending crafted ICMPv6 Neighbor Discovery packets with zero-length options, causing affected daemons to hang due to missing validation of the nd_opt_len field before arithmetic operations. OpenBSD versions through 7.8 are affected. No evidence of active exploitation has been identified.
Technical ContextAI
The vulnerability exists in OpenBSD's IPv6 stateless address autoconfiguration and router advertisement daemons (slaacd and rad), which process ICMPv6 Neighbor Discovery (ND) packets per RFC 4861. These daemons parse ND options, which include a length field (nd_opt_len) measured in 8-byte units. The vulnerable code performs the calculation 'nd_opt_len * 8 - 2' without first validating that nd_opt_len is non-zero. When nd_opt_len equals zero, this expression evaluates to -2, causing integer underflow or logic errors that trap the daemon in an infinite loop during option processing. The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), reflecting the missing bounds check on a network-supplied value before use in arithmetic operations. The attack vector is restricted to local network access (AV:A in CVSS), as ICMPv6 ND messages do not route across the internet by default.
RemediationAI
Apply the OpenBSD errata patch from https://www.openbsd.org/errata78.html, which adds validation to ensure nd_opt_len is non-zero before performing the calculation 'nd_opt_len * 8 - 2'. The fix is confirmed in upstream commit 086c5738bcd3c203bcc08d024fcf983cb409115f on OpenBSD's source repository. For production systems, upgrade to the patched version as distributed through OpenBSD security advisories. In environments where immediate patching is not feasible, restrict access to the local network segment through network segmentation and firewall rules to prevent untrusted hosts from sending crafted ICMPv6 packets to systems running vulnerable slaacd or rad daemons. Monitor daemon uptime and log files for unexpected restarts or hanging processes, as the infinite loop will cause daemons to become unresponsive to legitimate ICMPv6 messages, potentially disrupting IPv6 address autoconfiguration. This workaround does not eliminate the vulnerability but reduces the likelihood of malicious triggering.
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be
The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N
NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers
iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for chec
libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiu
Authentication bypass in OpenBSD's sppp PAP handler (sppp_pap_input in sys/net/if_spppsubr.c) lets an adjacent attacker
Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code
Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with ke
OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to beco
xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH envir
In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today