{"id":"CVE-2026-56114","aliases":["ALPINE-CVE-2026-56114","AZL-90216","BELL-CVE-2026-56114","DEBIAN-CVE-2026-56114","EUVD-2026-38492","GHSA-8q8g-fjv5-5h56","MGASA-2026-0335","UBUNTU-CVE-2026-56114"],"status":"published","title":"dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00269,"percentile":0.19272,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-06-23T16:08:10Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dhcpcd","fixed_in":["10.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dhcpcd","fixed_in":["10.5.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"dhcpcd","fixed_in":["10.0.8-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"dhcpcd","fixed_in":["9.4.1-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"dhcpcd","fixed_in":["10.2.3-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"dhcpcd","fixed_in":["10.3.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dhcpcd","fixed_in":["1:10.1.0-11+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dhcpcd","fixed_in":["1:10.3.2-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dhcpcd5","fixed_in":["9.4.1-24~deb12u5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.8-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.1-r1"},{"fixed":"9.4.1-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.3-r0"},{"fixed":"10.2.3-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.1-r3"},{"fixed":"10.3.2-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-11+deb13u3"}]}],"versions":["1:10.1.0-11","1:10.1.0-11+deb13u1","1:10.1.0-11+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.3.2-4"}]}],"versions":["1:10.1.0-11","1:10.1.0-12","1:10.2.0-1","1:10.2.2-1","1:10.2.2-2","1:10.2.2-3","1:10.2.2-4","1:10.2.2-5","1:10.2.2-6","1:10.2.3-1","1:10.2.4-1","1:10.2.4-2","1:10.2.4-3","1:10.2.4-4","1:10.2.4-4~bpo13+1","1:10.3.0-1","1:10.3.0-2","1:10.3.0-2~bpo13+1","1:10.3.0-3","1:10.3.0-3~bpo13+1","1:10.3.0-4","1:10.3.0-5","1:10.3.0-6","1:10.3.0-7","1:10.3.0-7~bpo13+1","1:10.3.1-1","1:10.3.1-1~bpo13+1","1:10.3.1-2","1:10.3.1-3","1:10.3.1-4","1:10.3.1-5","1:10.3.1-5~bpo13+1","1:10.3.2-1","1:10.3.2-2","1:10.3.2-3","1:10.3.2-3~bpo13+1","1:10.3.2-4~bpo13+1"]},{"source":"osv","ecosystem":"Debian:12","package":"dhcpcd5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.1-24~deb12u5"}]}],"versions":["9.4.1-22","9.4.1-23","9.4.1-24~deb12u1","9.4.1-24~deb12u2","9.4.1-24~deb12u3","9.4.1-24~deb12u4"]},{"source":"osv","ecosystem":"Mageia:10","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-1.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0.2-3ubuntu3","1:10.0.5-1","1:10.0.5-2","1:10.0.5-3","1:10.0.5-4","1:10.0.5-5","1:10.0.6-1","1:10.0.6-1ubuntu1","1:10.0.6-1ubuntu2","1:10.0.6-1ubuntu3","1:10.0.6-1ubuntu3.1","1:10.0.6-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0-8","1:10.1.0-10","1:10.1.0-11","1:10.1.0-12","1:10.2.4-3","1:10.2.4-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.4-4","1:10.3.0-2","1:10.3.0-3","1:10.3.0-7"]}],"products":[{"vendor":"dhcpcd_project","product":"dhcpcd"},{"vendor":"networkconfiguration","product":"dhcpcd"}],"references":[{"url":"https://github.com/NetworkConfiguration/dhcpcd/commit/2f00c7bfc408b6582d331932dfa47829c4819029","tags":["patch","Patch","fix"]},{"url":"https://www.vulncheck.com/advisories/dhcpcd-stack-out-of-bounds-write-in-dhcp6-makemessage","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56114","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8q8g-fjv5-5h56"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-56114","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56114","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56114.json","tags":["advisory"]},{"url":"https://github.com/NetworkConfiguration/dhcpcd","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56114","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0335.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36063","tags":["report"]},{"url":"https://github.com/NetworkConfiguration/dhcpcd/pull/676","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-56114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56114","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-56114","title":"dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T16:08:10.043Z","modified":"2026-07-28T01:49:42.486Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-38492","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T16:08:10Z","modified":"2026-07-28T01:49:42Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:32.258903Z"}],"ghsa":[{"id":"GHSA-8q8g-fjv5-5h56","title":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write...","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T18:31:43Z","modified":"2026-06-23T18:31:52Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:08:57.478089Z"}],"nvd":[{"id":"CVE-2026-56114","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T17:17:09.163Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"ALPINE-CVE-2026-56114","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T17:17:09.163Z","modified":"2026-10-01T02:17:49.352372089Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-56114","status":"published","published":"2026-06-25T06:12:51.948629Z","modified":"2026-07-07T07:15:44.301170079Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-56114","title":"dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T16:08:10.043Z","modified":"2026-11-11T13:23:01.010969744Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-11T03:21:28.618498Z"},{"id":"DEBIAN-CVE-2026-56114","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T17:17:09.163Z","modified":"2026-10-26T11:47:26.970559346Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"UBUNTU-CVE-2026-56114","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T17:17:00Z","modified":"2026-06-29T13:56:55.164152925Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-90216","title":"CVE-2026-56114 affecting package dhcpcd for versions less than 10.0.8-2","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T17:17:09Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0335","title":"Updated dhcpcd packages fix security vulnerabilities","description":"Attackers can send a crafted DHCPv6 ADVERTISE message containing an\nIA_PD\nIAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix\nlength\nof /121 through /128 to trigger the out-of-bounds write and potentially\ncorrupt adjacent stack memory (CVE: CVE-2026-56114).\nAttackers can repeatedly send Router Advertisements containing Route\nInformation options with a lifetime of zero, triggering unfreed\nallocations in routeinfo_findalloc() that cause linear memory\nexhaustion and eventual daemon crash (CVE: CVE-2026-56116).\n","status":"published","published":"2026-08-13T21:59:25Z","modified":"2026-08-13T22:00:03.705227515Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}