Odhcpd
Monthly
Unauthenticated flooding of crafted DHCPv6 RENEW messages can repeatedly crash odhcpd, the DHCPv6/DHCPv4/router-advertisement server shipped and enabled by default on OpenWrt, denying IPv6 address configuration to clients on the local link. An attacker who is network-adjacent (AV:A, PR:N, UI:N) must first complete two legitimate SOLICIT/REQUEST exchanges to obtain bindings, then send a single RENEW containing multiple IA_NA options that triggers an unsigned size_t underflow and lets attacker-controlled data be serialized past the 512-byte stack buffer pdbuf; the stack canary terminates the daemon and procd respawns it, so sustained packets cause recurring DHCPv6 outages. Impact is availability-only (C:N/I:N/A:H) and the observed configuration does not establish code execution; no public exploit identified at time of analysis, and the issue is fixed in OpenWrt 25.12.5.
Unauthenticated flooding of crafted DHCPv6 RENEW messages can repeatedly crash odhcpd, the DHCPv6/DHCPv4/router-advertisement server shipped and enabled by default on OpenWrt, denying IPv6 address configuration to clients on the local link. An attacker who is network-adjacent (AV:A, PR:N, UI:N) must first complete two legitimate SOLICIT/REQUEST exchanges to obtain bindings, then send a single RENEW containing multiple IA_NA options that triggers an unsigned size_t underflow and lets attacker-controlled data be serialized past the 512-byte stack buffer pdbuf; the stack canary terminates the daemon and procd respawns it, so sustained packets cause recurring DHCPv6 outages. Impact is availability-only (C:N/I:N/A:H) and the observed configuration does not establish code execution; no public exploit identified at time of analysis, and the issue is fixed in OpenWrt 25.12.5.