{"id":"CVE-2026-56116","aliases":["ALPINE-CVE-2026-56116","AZL-90219","BELL-CVE-2026-56116","DEBIAN-CVE-2026-56116","EUVD-2026-38496","GHSA-g36w-q35r-qvg3","MGASA-2026-0335","SUSE-SU-2026:23400-1","SUSE-SU-2026:23562-1","UBUNTU-CVE-2026-56116","openSUSE-SU-2026:11473-1","openSUSE-SU-2026:21692-1"],"status":"published","title":"dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00288,"percentile":0.21618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2026-06-23T16:11:52Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dhcpcd","fixed_in":["10.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dhcpcd","fixed_in":["10.5.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"dhcpcd","fixed_in":["10.0.8-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"dhcpcd","fixed_in":["10.2.3-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"dhcpcd","fixed_in":["10.3.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dhcpcd","fixed_in":["1:10.1.0-11+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dhcpcd","fixed_in":["1:10.3.2-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.7"},{"fixed":"10.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.7"},{"fixed":"10.5.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.8-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.3-r0"},{"fixed":"10.2.3-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.1-r3"},{"fixed":"10.3.2-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-11+deb13u3"}]}],"versions":["1:10.1.0-11","1:10.1.0-11+deb13u1","1:10.1.0-11+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.3.2-4"}]}],"versions":["1:10.1.0-11","1:10.1.0-12","1:10.2.0-1","1:10.2.2-1","1:10.2.2-2","1:10.2.2-3","1:10.2.2-4","1:10.2.2-5","1:10.2.2-6","1:10.2.3-1","1:10.2.4-1","1:10.2.4-2","1:10.2.4-3","1:10.2.4-4","1:10.2.4-4~bpo13+1","1:10.3.0-1","1:10.3.0-2","1:10.3.0-2~bpo13+1","1:10.3.0-3","1:10.3.0-3~bpo13+1","1:10.3.0-4","1:10.3.0-5","1:10.3.0-6","1:10.3.0-7","1:10.3.0-7~bpo13+1","1:10.3.1-1","1:10.3.1-1~bpo13+1","1:10.3.1-2","1:10.3.1-3","1:10.3.1-4","1:10.3.1-5","1:10.3.1-5~bpo13+1","1:10.3.2-1","1:10.3.2-2","1:10.3.2-3","1:10.3.2-3~bpo13+1","1:10.3.2-4~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:10","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-1.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0-8","1:10.1.0-10","1:10.1.0-11","1:10.1.0-12","1:10.2.4-3","1:10.2.4-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.4-4","1:10.3.0-2","1:10.3.0-3","1:10.3.0-7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"dhcpcd_project","product":"dhcpcd"},{"vendor":"networkconfiguration","product":"dhcpcd"}],"references":[{"url":"https://github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0","tags":["patch","Patch","fix"]},{"url":"https://www.vulncheck.com/advisories/dhcpcd-memory-leak-dos-via-ipv6-router-advertisement-handling","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56116","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g36w-q35r-qvg3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-56116","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56116","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56116.json","tags":["advisory"]},{"url":"https://github.com/NetworkConfiguration/dhcpcd","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56116","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0335.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36063","tags":["report"]},{"url":"https://github.com/NetworkConfiguration/dhcpcd/pull/676","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623400-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268968","tags":["report"]},{"url":"https://bugzilla.suse.com/1268974","tags":["report"]},{"url":"https://bugzilla.suse.com/1268976","tags":["report"]},{"url":"https://bugzilla.suse.com/1268980","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56117","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623562-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56116","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56116","title":"dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","status":"published","published":"2026-06-23T16:11:52.661Z","modified":"2026-07-28T01:49:43.887Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T13:37:02.780526Z"}],"euvd":[{"id":"EUVD-2026-38496","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","status":"published","published":"2026-06-23T16:11:52Z","modified":"2026-07-28T01:49:43Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:32.258903Z"}],"ghsa":[{"id":"GHSA-g36w-q35r-qvg3","title":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6...","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","status":"published","published":"2026-06-23T18:31:43Z","modified":"2026-06-23T18:31:52Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:08:57.478089Z"}],"nvd":[{"id":"CVE-2026-56116","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","status":"published","published":"2026-06-23T17:17:09.41Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"ALPINE-CVE-2026-56116","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","status":"published","published":"2026-06-23T17:17:09.41Z","modified":"2026-10-09T09:30:02.626744424Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-56116","status":"published","published":"2026-06-25T06:12:52.70398Z","modified":"2026-07-07T07:15:44.623908043Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-56116","title":"dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","status":"published","published":"2026-06-23T16:11:52.661Z","modified":"2026-10-28T11:17:49.294403747Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:45:11.609219Z"},{"id":"DEBIAN-CVE-2026-56116","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","status":"published","published":"2026-06-23T17:17:09.41Z","modified":"2026-10-26T11:47:31.031332048Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"UBUNTU-CVE-2026-56116","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","status":"published","published":"2026-06-23T17:17:00Z","modified":"2026-09-25T00:40:33.169307504Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-90219","title":"CVE-2026-56116 affecting package dhcpcd for versions less than 10.0.8-2","description":"dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.","status":"published","published":"2026-06-23T17:17:09Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0335","title":"Updated dhcpcd packages fix security vulnerabilities","description":"Attackers can send a crafted DHCPv6 ADVERTISE message containing an\nIA_PD\nIAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix\nlength\nof /121 through /128 to trigger the out-of-bounds write and potentially\ncorrupt adjacent stack memory (CVE: CVE-2026-56114).\nAttackers can repeatedly send Router Advertisements containing Route\nInformation options with a lifetime of zero, triggering unfreed\nallocations in routeinfo_findalloc() that cause linear memory\nexhaustion and eventual daemon crash (CVE: CVE-2026-56116).\n","status":"published","published":"2026-08-13T21:59:25Z","modified":"2026-08-13T22:00:03.705227515Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11473-1","title":"dhcpcd-10.5.0-1.1 on GA media","description":"These are all security issues fixed in the dhcpcd-10.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-09T00:00:00Z","modified":"2026-08-10T08:15:09.297944418Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21692-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don't really expire the lease when testing\n  * DHCP: Don't add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don't open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don't read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n","status":"published","published":"2026-08-30T14:33:19Z","modified":"2026-08-31T18:15:05.151549467Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23400-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don't really expire the lease when testing\n  * DHCP: Don't add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don't open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don't read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n","status":"published","published":"2026-08-30T14:33:20Z","modified":"2026-09-10T18:23:19.870061131Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23562-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don't really expire the lease when testing\n  * DHCP: Don't add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don't open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don't read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n","status":"published","published":"2026-08-30T14:33:20Z","modified":"2026-09-29T18:23:08.595740953Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}