{"id":"CVE-2026-56117","aliases":["ALPINE-CVE-2026-56117","AZL-90222","BELL-CVE-2026-56117","DEBIAN-CVE-2026-56117","EUVD-2026-38498","GHSA-p284-r695-7gxf","SUSE-SU-2026:23400-1","SUSE-SU-2026:23562-1","UBUNTU-CVE-2026-56117","openSUSE-SU-2026:11473-1","openSUSE-SU-2026:21692-1"],"status":"published","title":"dhcpcd Heap Use-After-Free via Control Socket Handling","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","severity":{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00135,"percentile":0.03051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-06-23T16:14:31Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dhcpcd","fixed_in":["10.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dhcpcd","fixed_in":["10.5.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"dhcpcd","fixed_in":["10.0.8-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"dhcpcd","fixed_in":["10.2.3-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"dhcpcd","fixed_in":["10.3.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dhcpcd","fixed_in":["1:10.1.0-11+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dhcpcd","fixed_in":["1:10.3.2-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.8-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.3-r0"},{"fixed":"10.2.3-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.1-r3"},{"fixed":"10.3.2-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-11+deb13u3"}]}],"versions":["1:10.1.0-11","1:10.1.0-11+deb13u1","1:10.1.0-11+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.3.2-4"}]}],"versions":["1:10.1.0-11","1:10.1.0-12","1:10.2.0-1","1:10.2.2-1","1:10.2.2-2","1:10.2.2-3","1:10.2.2-4","1:10.2.2-5","1:10.2.2-6","1:10.2.3-1","1:10.2.4-1","1:10.2.4-2","1:10.2.4-3","1:10.2.4-4","1:10.2.4-4~bpo13+1","1:10.3.0-1","1:10.3.0-2","1:10.3.0-2~bpo13+1","1:10.3.0-3","1:10.3.0-3~bpo13+1","1:10.3.0-4","1:10.3.0-5","1:10.3.0-6","1:10.3.0-7","1:10.3.0-7~bpo13+1","1:10.3.1-1","1:10.3.1-1~bpo13+1","1:10.3.1-2","1:10.3.1-3","1:10.3.1-4","1:10.3.1-5","1:10.3.1-5~bpo13+1","1:10.3.2-1","1:10.3.2-2","1:10.3.2-3","1:10.3.2-3~bpo13+1","1:10.3.2-4~bpo13+1"]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0.2-3ubuntu3","1:10.0.5-1","1:10.0.5-2","1:10.0.5-3","1:10.0.5-4","1:10.0.5-5","1:10.0.6-1","1:10.0.6-1ubuntu1","1:10.0.6-1ubuntu2","1:10.0.6-1ubuntu3","1:10.0.6-1ubuntu3.1","1:10.0.6-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0-8","1:10.1.0-10","1:10.1.0-11","1:10.1.0-12","1:10.2.4-3","1:10.2.4-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.4-4","1:10.3.0-2","1:10.3.0-3","1:10.3.0-7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dhcpcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"dhcpcd_project","product":"dhcpcd"},{"vendor":"networkconfiguration","product":"dhcpcd"}],"references":[{"url":"https://github.com/NetworkConfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34","tags":["patch","Patch","fix"]},{"url":"https://www.vulncheck.com/advisories/dhcpcd-heap-use-after-free-via-control-socket-handling","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56117","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p284-r695-7gxf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-56117","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56117","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56117.json","tags":["advisory"]},{"url":"https://github.com/NetworkConfiguration/dhcpcd","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56117","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623400-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268968","tags":["report"]},{"url":"https://bugzilla.suse.com/1268974","tags":["report"]},{"url":"https://bugzilla.suse.com/1268976","tags":["report"]},{"url":"https://bugzilla.suse.com/1268980","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56117","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623562-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56117","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56117","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56117","title":"dhcpcd Heap Use-After-Free via Control Socket Handling","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","status":"published","published":"2026-06-23T16:14:31.918Z","modified":"2026-07-28T01:49:44.651Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:37:02.780526Z"}],"euvd":[{"id":"EUVD-2026-38498","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","status":"published","published":"2026-06-23T16:14:31Z","modified":"2026-07-28T01:49:44Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:32.258903Z"}],"ghsa":[{"id":"GHSA-p284-r695-7gxf","title":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in...","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","status":"published","published":"2026-06-23T18:31:43Z","modified":"2026-06-23T18:31:52Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:08:57.478089Z"}],"nvd":[{"id":"CVE-2026-56117","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","status":"published","published":"2026-06-23T17:17:09.54Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"ALPINE-CVE-2026-56117","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","status":"published","published":"2026-06-23T17:17:09.54Z","modified":"2026-10-01T02:17:49.3536325Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-56117","status":"published","published":"2026-06-25T06:12:52.130422Z","modified":"2026-07-07T07:15:45.346728364Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-56117","title":"dhcpcd Heap Use-After-Free via Control Socket Handling","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","status":"published","published":"2026-06-23T16:14:31.918Z","modified":"2026-10-28T10:52:19.759249074Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:11.609219Z"},{"id":"DEBIAN-CVE-2026-56117","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","status":"published","published":"2026-06-23T17:17:09.54Z","modified":"2026-10-26T11:47:35.033203152Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"UBUNTU-CVE-2026-56117","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","status":"published","published":"2026-06-23T17:17:00Z","modified":"2026-06-29T13:56:54.663004307Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-90222","title":"CVE-2026-56117 affecting package dhcpcd for versions less than 10.0.8-2","description":"dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.","status":"published","published":"2026-06-23T17:17:09Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"openSUSE-SU-2026:11473-1","title":"dhcpcd-10.5.0-1.1 on GA media","description":"These are all security issues fixed in the dhcpcd-10.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-09T00:00:00Z","modified":"2026-08-10T08:15:09.297944418Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21692-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don't really expire the lease when testing\n  * DHCP: Don't add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don't open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don't read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n","status":"published","published":"2026-08-30T14:33:19Z","modified":"2026-08-31T18:15:05.151549467Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23400-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don't really expire the lease when testing\n  * DHCP: Don't add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don't open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don't read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n","status":"published","published":"2026-08-30T14:33:20Z","modified":"2026-09-10T18:23:19.870061131Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23562-1","title":"Security update for dhcpcd","description":"This update for dhcpcd fixes the following issues:\n\nUpdate to 10.5.0.\n\nSecurity issues fixed:\n\n- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).\n- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).\n- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a\n  memory leak (bsc#1268974).\n- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free\n  (bsc#1268968).\n\nChanges for dhcpcd:\n\n- 10.5.0:\n  * Add missing SPDX-License tags\n  * Format code with clang-format v19\n  * privsep: Change IPC to use SOCK_STREAM\n  * BPF: Split OS specific code out into own files and add libpcap\n    support\n  * hooks: Escape interface names and use printf\n  * Delete DHCPv6 IA FD from the loop before closing it\n  * eloop: Use kqueue or epoll to wait for a fd to become ready\n  * Darwin: Add initial support for macOS\n  * Import latest pidfile from NetBSD\n  * BPF: Improve headers\n  * compat: Add support for getprogname(3)\n  * route: Rework rt structure so sockaddrs are pointers\n  * dhcp-common: Escape ifname for lease file\n  * privsep: smaller buffer size without INET6\n  * script: add ifxname as the escaped string\n  * time.h always pulls in struct timespec\n  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define\n  * privsep: Test defines for all ioctls\n  * if: if_init inits the interface from the kernel\n  * privsep: Add ps_root_gethostname\n  * DHCP: Don't really expire the lease when testing\n  * DHCP: Don't add a trailing : on vendor if no machine arch\n  * privsep: guard setproctitle and only use compat on linux\n  * options: Remove some const to fix compile warnings\n  * privsep: Don't open PF_INET socket for each ioctl\n  * sun: Enable building for privsep\n  * script: Use correct buffer length variable\n  * privsep: Remove PS_BUFLEN\n  * privsep: Simplify readerror\n  * timezone: disallow directory traversal\n  * privsep: ps_root_readfile should return the real file size\n  * linux: Ensure NLA data boundaries are valid\n  * options: Fix userclass boundary\n  * ND6: fix OOB reject mask for an undefined option.\n  * DHCP6: Ensure IA_PD Prefix Lenth is valid\n  * ND: Enforce require and reject policy\n  * ARP: check we have enough to read the frame header\n  * hooks: Quote assignment of compat vars correctly\n  * udev: Ensure we have a subsystem, action and ifname\n  * Fix CI build\n  * DHCP: Santize messages from servers for output\n  * ARP: Iterate over states safely as the cb could remove ours\n  * privsep: Check data is terminated when a string\n  * auth: clear keys with memset_explicit\n  * auth: Ensure remaining dlen matches hash digest length\n  * hooks: don't read past truncated ip6 address starting fe\n  * ipv6: Only regen temp addrs with sufficent pltime\n  * eloop: Improve timespecdiff\n  * eloop: Fix compile warning where UTIME_MAX is a calculation\n  * vsio: Allow zero length options\n  * DHCP6: Fix configuring the suffix to delegated prefixes\n  * IPv6: Fix numerous issues extending temporary address times\n  * capsicum: Avoid some overflow issues in privsep sysctl\n  * script: Fix buffer over and under flows in script_buftoenv\n  * IPv4: uset old_ia when adding an address causes early removal\n  * dhcp: add configurable backoff parameters for DHCPv4\n  * options: Introdce policy groups\n  * Build all the targets on macos\n  * control: remove unprivileged socket\n  * DHCP: deconfigure even when state is NULL or NONE\n","status":"published","published":"2026-08-30T14:33:20Z","modified":"2026-09-29T18:23:08.595740953Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}