GO-2026-6237
Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp
In github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in a negative DHCP length, causing a panic in buf.Consume due to a negative slice bound.
What each source reports
OSV No score
Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp
In github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in a negative DHCP length, causing a panic in buf.Consume due to a negative slice bound.
- Record
GO-2026-6237- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/insomniacslk/dhcpGo |
before 0.0.0-20260719225207-c76316d4aa82 | 0.0.0-20260719225207-c76316d4aa82 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GO-2026-6237 is a vulnerability with no CVSS score yet in github.com/insomniacslk/dhcp, published August 18, 2026. No source lists public exploit code. Fixed in github.com/insomniacslk/dhcp 0.0.0-20260719225207-c76316d4aa82.