EUVD-2026-23996Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero.
AnalysisAI
Denial-of-service in OpenBSD slaacd and rad daemons allows local network attackers to trigger infinite loops by sending crafted ICMPv6 Neighbor Discovery packets with zero-length options, causing affected daemons to hang due to missing validation of the nd_opt_len field before arithmetic operations. OpenBSD versions through 7.8 are affected. No evidence of active exploitation has been identified.
Technical ContextAI
The vulnerability exists in OpenBSD's IPv6 stateless address autoconfiguration and router advertisement daemons (slaacd and rad), which process ICMPv6 Neighbor Discovery (ND) packets per RFC 4861. These daemons parse ND options, which include a length field (nd_opt_len) measured in 8-byte units. The vulnerable code performs the calculation 'nd_opt_len * 8 - 2' without first validating that nd_opt_len is non-zero. When nd_opt_len equals zero, this expression evaluates to -2, causing integer underflow or logic errors that trap the daemon in an infinite loop during option processing. The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), reflecting the missing bounds check on a network-supplied value before use in arithmetic operations. The attack vector is restricted to local network access (AV:A in CVSS), as ICMPv6 ND messages do not route across the internet by default.
RemediationAI
Apply the OpenBSD errata patch from https://www.openbsd.org/errata78.html, which adds validation to ensure nd_opt_len is non-zero before performing the calculation 'nd_opt_len * 8 - 2'. The fix is confirmed in upstream commit 086c5738bcd3c203bcc08d024fcf983cb409115f on OpenBSD's source repository. For production systems, upgrade to the patched version as distributed through OpenBSD security advisories. In environments where immediate patching is not feasible, restrict access to the local network segment through network segmentation and firewall rules to prevent untrusted hosts from sending crafted ICMPv6 packets to systems running vulnerable slaacd or rad daemons. Monitor daemon uptime and log files for unexpected restarts or hanging processes, as the infinite loop will cause daemons to become unresponsive to legitimate ICMPv6 messages, potentially disrupting IPv6 address autoconfiguration. This workaround does not eliminate the vulnerability but reduces the likelihood of malicious triggering.
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or e
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today