Every CVE Search/ Get API key

CVE-2026-14258

Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling

6.5 MediumFix available

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.40%Up 0.1 points since Jul 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Record
CVE-2026-14258
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-05
EUVDEUVD-2026-40941 6.5

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Record
EUVD-2026-40941
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-hm5v-wwxq-27x8 6.5

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially...

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Record
GHSA-hm5v-wwxq-27x8
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
NVD 6.5

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Record
CVE-2026-14258
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSVBELL-CVE-2026-14258 6.5
Record
BELL-CVE-2026-14258
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.5

Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Record
CVE-2026-14258
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-05
Show 6 moreShow less
OSVDEBIAN-CVE-2026-14258 6.5

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Record
DEBIAN-CVE-2026-14258
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:54210 6.5

Red Hat Security Advisory: dhcpcd security update

Record
RHSA-2026:54210
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:54210 6.5

Moderate: dhcpcd security update

The dhcpcd package provides a minimalistic network configuration daemon that supports IPv4 and IPv6 configuration including configuration discovery through NDP, DHCPv4 and DHCPv6 protocols.

Security Fix(es):

  • dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length IPv6 ND option in Router Advertisement handling (CVE-2026-14258)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:54210
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-14258 6.5

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Record
UBUNTU-CVE-2026-14258
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:54210 No score

Moderate: dhcpcd security update

The dhcpcd package provides a minimalistic network configuration daemon that supports IPv4 and IPv6 configuration including configuration discovery through NDP, DHCPv4 and DHCPv6 protocols.

Security Fix(es):

  • dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length IPv6 ND option in Router Advertisement handling (CVE-2026-14258)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:54210
Updated
2026-11-02
OSVAZL-91710 No score

CVE-2026-14258 affecting package dhcpcd for versions less than 10.0.8-4

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Record
AZL-91710
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dhcpcd
AlmaLinux:10
 before 10.0.6-11.el10_2
10.0.6-11.el10_2
dhcpcd
Azure Linux:3
 before 10.0.8-4
10.0.8-4
dhcpcd
Alpaquita:23
 9.4.1-r1 up to 9.4.1-r5
9.4.1-r5
dhcpcd
Alpaquita:stream
 9.4.1-r3 up to 10.2.0-r0
10.2.0-r0
dhcpcd
Debian:13
 before 1:10.1.0-11+deb13u4, plus listed versions
1:10.1.0-111:10.1.0-11+deb13u11:10.1.0-11+deb13u21:10.1.0-11+deb13u3
1:10.1.0-11+deb13u4
dhcpcd
Debian:14
 before 1:10.2.4-3, plus listed versions
1:10.1.0-111:10.1.0-121:10.2.0-11:10.2.2-11:10.2.2-2
Show 7 moreShow less
1:10.2.2-31:10.2.2-41:10.2.2-51:10.2.2-61:10.2.3-11:10.2.4-11:10.2.4-2
1:10.2.4-3
dhcpcd
Red Hat:enterprise_linux:10.2
 before 0:10.0.6-11.el10_2
0:10.0.6-11.el10_2
dhcpcd-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:10.0.6-11.el10_2
0:10.0.6-11.el10_2
dhcpcd-debugsource
Red Hat:enterprise_linux:10.2
 before 0:10.0.6-11.el10_2
0:10.0.6-11.el10_2
dhcpcd
Rocky Linux:10
 before 0:10.0.6-11.el10_2
0:10.0.6-11.el10_2
dhcpcd
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:10.0.2-3ubuntu31:10.0.5-11:10.0.5-21:10.0.5-31:10.0.5-4
Show 7 moreShow less
1:10.0.5-51:10.0.6-11:10.0.6-1ubuntu11:10.0.6-1ubuntu21:10.0.6-1ubuntu31:10.0.6-1ubuntu3.11:10.0.6-1ubuntu3.2
 None known
dhcpcd
Ubuntu:25.10
 All versions, plus listed versions
1:10.1.0-81:10.1.0-101:10.1.0-111:10.1.0-121:10.2.4-31:10.2.4-4
 None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-14258 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published July 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in dhcpcd 10.0.6-11.el10_2.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open