{"id":"CVE-2026-18103","aliases":["DEBIAN-CVE-2026-18103","EUVD-2026-52999","GHSA-wq4j-5vp3-jcrx","UBUNTU-CVE-2026-18103"],"status":"published","title":"Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi","description":"A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00709,"percentile":0.53826,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120"],"published":"2026-08-04T23:08:02Z","modified":"2026-11-10T21:31:36Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-P1-2","4.4.3-P1-3","4.4.3-P1-4","4.4.3-P1-5","4.4.3-P1-5~exp1","4.4.3-P1-5~exp2","4.4.3-P1-6","4.4.3-P1-7","4.4.3-P1-8"]},{"source":"osv","ecosystem":"Debian:13","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-P1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.4-7ubuntu8","4.2.4-7ubuntu9","4.2.4-7ubuntu10","4.2.4-7ubuntu11","4.2.4-7ubuntu12","4.2.4-7ubuntu12.1","4.2.4-7ubuntu12.2","4.2.4-7ubuntu12.3","4.2.4-7ubuntu12.4","4.2.4-7ubuntu12.5","4.2.4-7ubuntu12.6","4.2.4-7ubuntu12.7","4.2.4-7ubuntu12.8","4.2.4-7ubuntu12.9","4.2.4-7ubuntu12.10","4.2.4-7ubuntu12.12","4.2.4-7ubuntu12.13","4.2.4-7ubuntu12.13+esm1","4.2.4-7ubuntu12.13+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.1-5ubuntu3","4.3.1-5ubuntu4","4.3.1-5ubuntu5","4.3.3-5ubuntu1","4.3.3-5ubuntu2","4.3.3-5ubuntu4","4.3.3-5ubuntu5","4.3.3-5ubuntu7","4.3.3-5ubuntu8","4.3.3-5ubuntu9","4.3.3-5ubuntu10","4.3.3-5ubuntu11","4.3.3-5ubuntu12","4.3.3-5ubuntu12.1","4.3.3-5ubuntu12.3","4.3.3-5ubuntu12.4","4.3.3-5ubuntu12.6","4.3.3-5ubuntu12.7","4.3.3-5ubuntu12.9","4.3.3-5ubuntu12.10","4.3.3-5ubuntu12.10+esm1","4.3.3-5ubuntu12.10+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.5-3ubuntu2","4.3.5-3ubuntu3","4.3.5-3ubuntu4","4.3.5-3ubuntu5","4.3.5-3ubuntu6","4.3.5-3ubuntu7","4.3.5-3ubuntu7.1","4.3.5-3ubuntu7.2","4.3.5-3ubuntu7.3","4.3.5-3ubuntu7.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-2ubuntu5","4.4.1-2ubuntu6","4.4.1-2.1ubuntu1","4.4.1-2.1ubuntu2","4.4.1-2.1ubuntu3","4.4.1-2.1ubuntu4","4.4.1-2.1ubuntu5","4.4.1-2.1ubuntu5.20.04.1","4.4.1-2.1ubuntu5.20.04.2","4.4.1-2.1ubuntu5.20.04.3","4.4.1-2.1ubuntu5.20.04.4","4.4.1-2.1ubuntu5.20.04.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-2.3ubuntu1","4.4.1-2.3ubuntu2","4.4.1-2.3ubuntu2.1","4.4.1-2.3ubuntu2.2","4.4.1-2.3ubuntu2.3","4.4.1-2.3ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-P1-2ubuntu5","4.4.3-P1-4ubuntu1","4.4.3-P1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-P1-4ubuntu2"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:97486","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18103","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508081","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18103"},{"url":"https://github.com/advisories/GHSA-wq4j-5vp3-jcrx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-18103","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-18103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18103","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-18103","title":"Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi","description":"A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.","status":"published","published":"2026-08-04T23:08:02.438Z","modified":"2026-11-10T20:35:52.672Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-10T22:18:27.383863Z"}],"euvd":[{"id":"EUVD-2026-52999","description":"A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.","status":"published","published":"2026-08-04T23:08:02Z","modified":"2026-11-10T20:35:52Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-10T21:23:23.099302Z"}],"ghsa":[{"id":"GHSA-wq4j-5vp3-jcrx","title":"A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open...","description":"A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.","status":"published","published":"2026-08-05T00:30:40Z","modified":"2026-11-10T21:31:36Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-10T21:57:46.822341Z"}],"nvd":[{"id":"CVE-2026-18103","description":"A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.","status":"published","published":"2026-08-05T00:16:59.11Z","modified":"2026-11-10T21:19:28.24Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-11T00:21:50.254612Z"}],"osv":[{"id":"DEBIAN-CVE-2026-18103","description":"A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.","status":"published","published":"2026-08-05T00:16:59.11Z","modified":"2026-11-07T09:47:29.355568123Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"UBUNTU-CVE-2026-18103","description":"A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.","status":"published","published":"2026-08-05T00:16:00Z","modified":"2026-08-19T11:01:27Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:01.334185Z"}]}}