Every CVE Search/ Get API key

CVE-2026-56113

dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW

6.0 MediumFix available

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.27%Up 0.1 points since Jun 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.0

dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Record
CVE-2026-56113
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-38491 6.0

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Record
EUVD-2026-38491
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vh4p-87xg-jc4x 6.0

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that...

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Record
GHSA-vh4p-87xg-jc4x
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 6.0

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Record
CVE-2026-56113
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2026-56113 6.5

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Record
ALPINE-CVE-2026-56113
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-56113 6.5
Record
BELL-CVE-2026-56113
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSV 6.0

dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Record
CVE-2026-56113
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-56113 6.5

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Record
DEBIAN-CVE-2026-56113
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-56113 6.0

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Record
UBUNTU-CVE-2026-56113
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
5.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-90213 No score

CVE-2026-56113 affecting package dhcpcd for versions less than 10.0.8-4

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Record
AZL-90213
Updated
2026-11-02
OSVopenSUSE-SU-2026:11473-1 No score

dhcpcd-10.5.0-1.1 on GA media

These are all security issues fixed in the dhcpcd-10.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11473-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21692-1 No score

Security update for dhcpcd

This update for dhcpcd fixes the following issues:

Update to 10.5.0.

Security issues fixed:

  • CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).
  • CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).
  • CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a memory leak (bsc#1268974).
  • CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free (bsc#1268968).

Changes for dhcpcd:

  • 10.5.0:
    • Add missing SPDX-License tags
    • Format code with clang-format v19
    • privsep: Change IPC to use SOCK_STREAM
    • BPF: Split OS specific code out into own files and add libpcap support
    • hooks: Escape interface names and use printf
    • Delete DHCPv6 IA FD from the loop before closing it
    • eloop: Use kqueue or epoll to wait for a fd to become ready
    • Darwin: Add initial support for macOS
    • Import latest pidfile from NetBSD
    • BPF: Improve headers
    • compat: Add support for getprogname(3)
    • route: Rework rt structure so sockaddrs are pointers
    • dhcp-common: Escape ifname for lease file
    • privsep: smaller buffer size without INET6
    • script: add ifxname as the escaped string
    • time.h always pulls in struct timespec
    • route: Use HAVE_RT_MISSFILTER rather than a generic BSD define
    • privsep: Test defines for all ioctls
    • if: if_init inits the interface from the kernel
    • privsep: Add ps_root_gethostname
    • DHCP: Don't really expire the lease when testing
    • DHCP: Don't add a trailing : on vendor if no machine arch
    • privsep: guard setproctitle and only use compat on linux
    • options: Remove some const to fix compile warnings
    • privsep: Don't open PF_INET socket for each ioctl
    • sun: Enable building for privsep
    • script: Use correct buffer length variable
    • privsep: Remove PS_BUFLEN
    • privsep: Simplify readerror
    • timezone: disallow directory traversal
    • privsep: ps_root_readfile should return the real file size
    • linux: Ensure NLA data boundaries are valid
    • options: Fix userclass boundary
    • ND6: fix OOB reject mask for an undefined option.
    • DHCP6: Ensure IA_PD Prefix Lenth is valid
    • ND: Enforce require and reject policy
    • ARP: check we have enough to read the frame header
    • hooks: Quote assignment of compat vars correctly
    • udev: Ensure we have a subsystem, action and ifname
    • Fix CI build
    • DHCP: Santize messages from servers for output
    • ARP: Iterate over states safely as the cb could remove ours
    • privsep: Check data is terminated when a string
    • auth: clear keys with memset_explicit
    • auth: Ensure remaining dlen matches hash digest length
    • hooks: don't read past truncated ip6 address starting fe
    • ipv6: Only regen temp addrs with sufficent pltime
    • eloop: Improve timespecdiff
    • eloop: Fix compile warning where UTIME_MAX is a calculation
    • vsio: Allow zero length options
    • DHCP6: Fix configuring the suffix to delegated prefixes
    • IPv6: Fix numerous issues extending temporary address times
    • capsicum: Avoid some overflow issues in privsep sysctl
    • script: Fix buffer over and under flows in script_buftoenv
    • IPv4: uset old_ia when adding an address causes early removal
    • dhcp: add configurable backoff parameters for DHCPv4
    • options: Introdce policy groups
    • Build all the targets on macos
    • control: remove unprivileged socket
    • DHCP: deconfigure even when state is NULL or NONE
Record
openSUSE-SU-2026:21692-1
Updated
2026-11-02
OSVSUSE-SU-2026:23400-1 No score

Security update for dhcpcd

This update for dhcpcd fixes the following issues:

Update to 10.5.0.

Security issues fixed:

  • CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).
  • CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).
  • CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a memory leak (bsc#1268974).
  • CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free (bsc#1268968).

Changes for dhcpcd:

  • 10.5.0:
    • Add missing SPDX-License tags
    • Format code with clang-format v19
    • privsep: Change IPC to use SOCK_STREAM
    • BPF: Split OS specific code out into own files and add libpcap support
    • hooks: Escape interface names and use printf
    • Delete DHCPv6 IA FD from the loop before closing it
    • eloop: Use kqueue or epoll to wait for a fd to become ready
    • Darwin: Add initial support for macOS
    • Import latest pidfile from NetBSD
    • BPF: Improve headers
    • compat: Add support for getprogname(3)
    • route: Rework rt structure so sockaddrs are pointers
    • dhcp-common: Escape ifname for lease file
    • privsep: smaller buffer size without INET6
    • script: add ifxname as the escaped string
    • time.h always pulls in struct timespec
    • route: Use HAVE_RT_MISSFILTER rather than a generic BSD define
    • privsep: Test defines for all ioctls
    • if: if_init inits the interface from the kernel
    • privsep: Add ps_root_gethostname
    • DHCP: Don't really expire the lease when testing
    • DHCP: Don't add a trailing : on vendor if no machine arch
    • privsep: guard setproctitle and only use compat on linux
    • options: Remove some const to fix compile warnings
    • privsep: Don't open PF_INET socket for each ioctl
    • sun: Enable building for privsep
    • script: Use correct buffer length variable
    • privsep: Remove PS_BUFLEN
    • privsep: Simplify readerror
    • timezone: disallow directory traversal
    • privsep: ps_root_readfile should return the real file size
    • linux: Ensure NLA data boundaries are valid
    • options: Fix userclass boundary
    • ND6: fix OOB reject mask for an undefined option.
    • DHCP6: Ensure IA_PD Prefix Lenth is valid
    • ND: Enforce require and reject policy
    • ARP: check we have enough to read the frame header
    • hooks: Quote assignment of compat vars correctly
    • udev: Ensure we have a subsystem, action and ifname
    • Fix CI build
    • DHCP: Santize messages from servers for output
    • ARP: Iterate over states safely as the cb could remove ours
    • privsep: Check data is terminated when a string
    • auth: clear keys with memset_explicit
    • auth: Ensure remaining dlen matches hash digest length
    • hooks: don't read past truncated ip6 address starting fe
    • ipv6: Only regen temp addrs with sufficent pltime
    • eloop: Improve timespecdiff
    • eloop: Fix compile warning where UTIME_MAX is a calculation
    • vsio: Allow zero length options
    • DHCP6: Fix configuring the suffix to delegated prefixes
    • IPv6: Fix numerous issues extending temporary address times
    • capsicum: Avoid some overflow issues in privsep sysctl
    • script: Fix buffer over and under flows in script_buftoenv
    • IPv4: uset old_ia when adding an address causes early removal
    • dhcp: add configurable backoff parameters for DHCPv4
    • options: Introdce policy groups
    • Build all the targets on macos
    • control: remove unprivileged socket
    • DHCP: deconfigure even when state is NULL or NONE
Record
SUSE-SU-2026:23400-1
Updated
2026-11-02
OSVSUSE-SU-2026:23562-1 No score

Security update for dhcpcd

This update for dhcpcd fixes the following issues:

Update to 10.5.0.

Security issues fixed:

  • CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).
  • CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).
  • CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a memory leak (bsc#1268974).
  • CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free (bsc#1268968).

Changes for dhcpcd:

  • 10.5.0:
    • Add missing SPDX-License tags
    • Format code with clang-format v19
    • privsep: Change IPC to use SOCK_STREAM
    • BPF: Split OS specific code out into own files and add libpcap support
    • hooks: Escape interface names and use printf
    • Delete DHCPv6 IA FD from the loop before closing it
    • eloop: Use kqueue or epoll to wait for a fd to become ready
    • Darwin: Add initial support for macOS
    • Import latest pidfile from NetBSD
    • BPF: Improve headers
    • compat: Add support for getprogname(3)
    • route: Rework rt structure so sockaddrs are pointers
    • dhcp-common: Escape ifname for lease file
    • privsep: smaller buffer size without INET6
    • script: add ifxname as the escaped string
    • time.h always pulls in struct timespec
    • route: Use HAVE_RT_MISSFILTER rather than a generic BSD define
    • privsep: Test defines for all ioctls
    • if: if_init inits the interface from the kernel
    • privsep: Add ps_root_gethostname
    • DHCP: Don't really expire the lease when testing
    • DHCP: Don't add a trailing : on vendor if no machine arch
    • privsep: guard setproctitle and only use compat on linux
    • options: Remove some const to fix compile warnings
    • privsep: Don't open PF_INET socket for each ioctl
    • sun: Enable building for privsep
    • script: Use correct buffer length variable
    • privsep: Remove PS_BUFLEN
    • privsep: Simplify readerror
    • timezone: disallow directory traversal
    • privsep: ps_root_readfile should return the real file size
    • linux: Ensure NLA data boundaries are valid
    • options: Fix userclass boundary
    • ND6: fix OOB reject mask for an undefined option.
    • DHCP6: Ensure IA_PD Prefix Lenth is valid
    • ND: Enforce require and reject policy
    • ARP: check we have enough to read the frame header
    • hooks: Quote assignment of compat vars correctly
    • udev: Ensure we have a subsystem, action and ifname
    • Fix CI build
    • DHCP: Santize messages from servers for output
    • ARP: Iterate over states safely as the cb could remove ours
    • privsep: Check data is terminated when a string
    • auth: clear keys with memset_explicit
    • auth: Ensure remaining dlen matches hash digest length
    • hooks: don't read past truncated ip6 address starting fe
    • ipv6: Only regen temp addrs with sufficent pltime
    • eloop: Improve timespecdiff
    • eloop: Fix compile warning where UTIME_MAX is a calculation
    • vsio: Allow zero length options
    • DHCP6: Fix configuring the suffix to delegated prefixes
    • IPv6: Fix numerous issues extending temporary address times
    • capsicum: Avoid some overflow issues in privsep sysctl
    • script: Fix buffer over and under flows in script_buftoenv
    • IPv4: uset old_ia when adding an address causes early removal
    • dhcp: add configurable backoff parameters for DHCPv4
    • options: Introdce policy groups
    • Build all the targets on macos
    • control: remove unprivileged socket
    • DHCP: deconfigure even when state is NULL or NONE
Record
SUSE-SU-2026:23562-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dhcpcd
Alpine:v3.23
 before 10.5.2-r0
10.5.2-r0
dhcpcd
Alpine:v3.24
 before 10.5.2-r0
10.5.2-r0
dhcpcd
Azure Linux:3
 before 10.0.8-4
10.0.8-4
dhcpcd
Alpaquita:23
 9.4.1-r1 up to 9.4.1-r4
9.4.1-r4
dhcpcd
Alpaquita:25
 10.2.3-r0 up to 10.2.3-r1
10.2.3-r1
dhcpcd
Alpaquita:stream
 9.4.1-r3 up to 10.3.2-r1
10.3.2-r1
dhcpcd
Debian:13
 before 1:10.1.0-11+deb13u3, plus listed versions
1:10.1.0-111:10.1.0-11+deb13u11:10.1.0-11+deb13u2
1:10.1.0-11+deb13u3
dhcpcd
Debian:14
 before 1:10.3.2-4, plus listed versions
1:10.1.0-111:10.1.0-121:10.2.0-11:10.2.2-11:10.2.2-2
Show 32 moreShow less
1:10.2.2-31:10.2.2-41:10.2.2-51:10.2.2-61:10.2.3-11:10.2.4-11:10.2.4-21:10.2.4-31:10.2.4-41:10.2.4-4~bpo13+11:10.3.0-11:10.3.0-21:10.3.0-2~bpo13+11:10.3.0-31:10.3.0-3~bpo13+11:10.3.0-41:10.3.0-51:10.3.0-61:10.3.0-71:10.3.0-7~bpo13+11:10.3.1-11:10.3.1-1~bpo13+11:10.3.1-21:10.3.1-31:10.3.1-41:10.3.1-51:10.3.1-5~bpo13+11:10.3.2-11:10.3.2-21:10.3.2-31:10.3.2-3~bpo13+11:10.3.2-4~bpo13+1
1:10.3.2-4
dhcpcd
SUSE:Linux Micro 6.2
 before 10.5.0-160000.1.1
10.5.0-160000.1.1
dhcpcd
SUSE:Linux Enterprise Server 16.0
 before 10.5.0-160000.1.1
10.5.0-160000.1.1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
dhcpcd
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 10.5.0-160000.1.1
10.5.0-160000.1.1
dhcpcd
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:10.0.2-3ubuntu31:10.0.5-11:10.0.5-21:10.0.5-31:10.0.5-4
Show 7 moreShow less
1:10.0.5-51:10.0.6-11:10.0.6-1ubuntu11:10.0.6-1ubuntu21:10.0.6-1ubuntu31:10.0.6-1ubuntu3.11:10.0.6-1ubuntu3.2
 None known
dhcpcd
Ubuntu:25.10
 All versions, plus listed versions
1:10.1.0-81:10.1.0-101:10.1.0-111:10.1.0-121:10.2.4-31:10.2.4-4
 None known
dhcpcd
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:10.2.4-41:10.3.0-21:10.3.0-31:10.3.0-7
 None known
dhcpcd
openSUSE:Tumbleweed
 before 10.5.0-1.1
10.5.0-1.1
dhcpcd
openSUSE:Leap 16.0
 before 10.5.0-160000.1.1
10.5.0-160000.1.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56113 is a medium vulnerability (CVSS 6.0) in Dhcpcd Project Dhcpcd, published June 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in dhcpcd 10.5.2-r0.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open