{"id":"CVE-2026-56115","aliases":["DEBIAN-CVE-2026-56115","EUVD-2026-38494","GHSA-vhmp-9f3g-3f36","SUSE-SU-2026:23400-1","SUSE-SU-2026:23562-1","UBUNTU-CVE-2026-56115","openSUSE-SU-2026:11473-1","openSUSE-SU-2026:21692-1"],"status":"published","title":"Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass","description":"Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00452,"percentile":0.39607,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787","CWE-862"],"published":"2026-06-23T16:08:55Z","modified":"2026-11-09T02:47:24Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0-8","1:10.1.0-10","1:10.1.0-11","1:10.1.0-12","1:10.2.4-3","1:10.2.4-4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"bootimus","product":"bootimus"},{"vendor":"garybowers","product":"bootimus"}],"references":[{"url":"https://github.com/garybowers/bootimus/issues/84","tags":["technical-description","exploit","issue-tracking","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://www.vulncheck.com/advisories/bootimus-broken-access-control-via-jwtmiddleware-authorization-bypass","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56115","tags":["advisory"]},{"url":"https://github.com/NetworkConfiguration/dhcpcd/commit/2f00c7bfc408b6582d331932dfa47829c4819029"},{"url":"https://www.vulncheck.com/advisories/dhcpcd-stack-out-of-bounds-write-in-dhcp6-makemessage"},{"url":"https://github.com/advisories/GHSA-vhmp-9f3g-3f36"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56115.json","tags":["advisory"]},{"url":"https://github.com/garybowers/bootimus","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56115","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623400-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268968","tags":["report"]},{"url":"https://bugzilla.suse.com/1268974","tags":["report"]},{"url":"https://bugzilla.suse.com/1268976","tags":["report"]},{"url":"https://bugzilla.suse.com/1268980","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56117","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623562-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56115","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56115","title":"Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass","description":"Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.","status":"published","published":"2026-06-23T16:08:55.358Z","modified":"2026-11-08T14:05:32.687Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-38494","description":"Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.","status":"published","published":"2026-06-23T16:08:55Z","modified":"2026-11-08T14:05:32Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:08.252361Z"}],"ghsa":[{"id":"GHSA-vhmp-9f3g-3f36","title":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write...","description":"dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory.","status":"published","published":"2026-06-23T18:31:43Z","modified":"2026-06-25T18:31:38Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787","CWE-862"],"updated_at":"2026-11-02T15:08:59.328511Z"}],"nvd":[{"id":"CVE-2026-56115","description":"Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.","status":"published","published":"2026-06-23T17:17:09.287Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"CVE-2026-56115","title":"Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass","description":"Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.","status":"published","published":"2026-06-23T16:08:55.358Z","modified":"2026-11-09T02:47:24.050928681Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-09T03:16:17.543303Z"},{"id":"DEBIAN-CVE-2026-56115","description":"Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.","status":"withdrawn","published":"2026-06-23T17:17:09.287Z","modified":"2026-06-26T08:01:37.28201889Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"UBUNTU-CVE-2026-56115","description":"Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.","status":"published","published":"2026-06-23T17:17:00Z","modified":"2026-09-25T00:40:32.915459651Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"openSUSE-SU-2026:11473-1","title":"dhcpcd-10.5.0-1.1 on GA media","description":"These are all security issues fixed in the dhcpcd-10.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-09T00:00:00Z","modified":"2026-08-10T08:15:09.297944418Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21692-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don't really expire the lease when testing\n  * DHCP: Don't add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don't open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don't read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n","status":"published","published":"2026-08-30T14:33:19Z","modified":"2026-08-31T18:15:05.151549467Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23400-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don't really expire the lease when testing\n  * DHCP: Don't add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don't open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don't read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n","status":"published","published":"2026-08-30T14:33:20Z","modified":"2026-09-10T18:23:19.870061131Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23562-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don't really expire the lease when testing\n  * DHCP: Don't add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don't open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don't read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n","status":"published","published":"2026-08-30T14:33:20Z","modified":"2026-09-29T18:23:08.595740953Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}