{"id":"CVE-2026-71402","aliases":["EUVD-2026-67080","GHSA-qwmv-r6fq-g9r3","SUSE-SU-2026:3837-1","SUSE-SU-2026:3839-1","SUSE-SU-2026:3840-1","SUSE-SU-2026:3841-1","SUSE-SU-2026:3842-1","openSUSE-SU-2026:11636-1","openSUSE-SU-2026:21669-1"],"status":"published","title":"wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length","description":"An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes — at most 68 bytes — past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00247,"percentile":0.16093,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125","CWE-130"],"published":"2026-08-27T12:19:36Z","modified":"2026-10-28T02:30:23Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-3.61.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-3.61.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150600.11.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150600.11.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150700.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150400.3.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150400.3.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150400.3.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150400.3.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150400.3.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.79-150400.3.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.80-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"wicked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.80-bp160.2.1"}]}],"bundled":2}],"products":[{"vendor":"suse","product":"wicked"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1274627","tags":["issue-tracking","report"]},{"url":"https://github.com/openSUSE/wicked/pull/1079","tags":["patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71402","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qwmv-r6fq-g9r3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71402.json","tags":["advisory"]},{"url":"https://github.com/openSUSE/wicked","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263837-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274627","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71402","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263839-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263840-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265221","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44932","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263841-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263842-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71402","title":"wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length","description":"An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes — at most 68 bytes — past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80.","status":"published","published":"2026-08-27T15:09:41.984Z","modified":"2026-08-27T19:30:42.063Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125","CWE-130"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-67080","description":"An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes — at most 68 bytes — past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80.","status":"published","published":"2026-08-27T15:09:41Z","modified":"2026-08-27T19:30:42Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:26.820985Z"}],"ghsa":[{"id":"GHSA-qwmv-r6fq-g9r3","title":"An out-of-bounds read was found in the DHCPv4 packet capture code of wicked....","description":"An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes — at most 68 bytes — past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80.","status":"published","published":"2026-08-27T18:32:23Z","modified":"2026-08-27T18:32:30Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:11:04.416708Z"}],"nvd":[{"id":"CVE-2026-71402","description":"An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes — at most 68 bytes — past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80.","status":"published","published":"2026-08-27T17:19:44.98Z","modified":"2026-09-01T20:54:51.287Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-125","CWE-130"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-71402","title":"wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length","description":"An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client (wickedd-dhcp4) reads up to ihl + 8 bytes — at most 68 bytes — past the end of the 1500-byte packet receive buffer. An unauthenticated attacker on the same network who sends a crafted DHCP/UDP packet can make the client parse adjacent heap memory as DHCP options, so that heap contents such as allocator metadata or pointer values can be interpreted into lease fields. The over-read is bounded to 68 bytes; no memory write, no attacker control over the adjacent bytes and no remote exfiltration primitive has been demonstrated. This issue affects wicked up to and including version 0.6.80.","status":"published","published":"2026-08-27T15:09:41.984Z","modified":"2026-10-28T02:30:23.399573881Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125","CWE-130"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"openSUSE-SU-2026:11636-1","title":"wicked-0.6.80-2.1 on GA media","description":"These are all security issues fixed in the wicked-0.6.80-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-08-29T09:15:04.355961249Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21669-1","title":"Security update for wicked","description":"This update for wicked fixes the following issues:\n\nChanges in wicked:\n\n- Fix two OOB reads in ni_capture_inspect_udp_header and improve:\n  - Reject packets with ip_len \u003c ihl to avoid a size_t underflow of the\n    UDP length, which the checksum truncates to uint16_t (bsc#1274627,\n    CVE-2026-71401).\n  - Set payload_len to the remaining payload, not ip_len, which over-read\n    the DHCP option walker by ihl + 8 bytes past the buffer (bsc#1274627,\n    CVE-2026-71402).\n  - Avoid checksumming packets that fail the length/protocol checks and\n    tidy up the debug messages (bsc#1274627).\n  - Fix underflow check in ni_dhcp4_option_next to handle option code\n    and length separately as the END and PAD options don't have length\n    (bsc#1274627).\n\n  Thanks to Daniel Birtwhistle for discovering and reporting the issues.\n","status":"published","published":"2026-08-27T16:26:05Z","modified":"2026-08-28T17:30:03.735063322Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:3837-1","title":"Security update for wicked","description":"This update for wicked fixes the following issue:\n\n- CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum handling of DHCPv4 capture parsing \n  (bsc#1274627).\n- CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended beyond provided allocation in DHCPv4\n  capture parsing (bsc#1274627).\n","status":"published","published":"2026-08-27T12:19:36Z","modified":"2026-09-04T18:23:11.700991727Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3839-1","title":"Security update for wicked","description":"This update for wicked fixes the following issue:\n\n- CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum handling of DHCPv4 capture parsing \n  (bsc#1274627).\n- CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended beyond provided allocation in DHCPv4\n  capture parsing (bsc#1274627).\n","status":"published","published":"2026-08-27T12:21:00Z","modified":"2026-09-04T18:23:11.907252315Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3840-1","title":"Security update for wicked","description":"This update for wicked fixes the following issues:\n\nUpdate to version 0.6.79.\n\n- CVE-2026-44932: indirect remote shell command injection due to insufficient sanitization of DHCP options written to\n  `/run/wicked/leaseinfo.*` files (bsc#1265221).\n- CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum handling of DHCPv4 capture parsing \n  (bsc#1274627).\n- CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended beyond provided allocation in DHCPv4\n  capture parsing (bsc#1274627).\n\nChanges for wicked:\n\n- Version 0.6.79:\n  - Fix to escape single-quotes in leaseinfo dump output used by the `wicked test dhcp4` and `wicked test dhcp6` and\n    written to the `/run/wicked/leaseinfo.*` files, e.g. to pass them to `netconfig`.\n  - Fix `posix-tz-dbname` and `tz-string` option processing checks to permit only valid characters according to\n    RFC4833.\n  - Discard string values containing single-quotes in other options.\n  - Trigger to regenerate `initrd` that may contain wicked binaries on updates from wicked versions \u003c= 0.6.78.\n- Version 0.6.78:\n  - `man`: small fixes in wireless manpage (gh#opensuse/wicked#1053)\n  - `rtnetlink`: fix `RTM_NEWLINK` name resolution in debug (gh#opensuse/wicked#1052)\n  - Add support for IPVLAN/IPVTAP (jsc#PED-1942, gh#opensuse/wicked#1050, gh#opensuse/wicked#1051)\n  - `fsm`: remove children reference array from worker (gh#opensuse/wicked#1049)\n  - `ifxml`: migrate and generate lower configs/policies (gh#opensuse/wicked#1048)\n  - `fsm`: use refcount and array macros in worker and policy (gh#opensuse/wicked#1047)\n  - `route`: use refcounted array and fix error leaks (gh#opensuse/wicked#1046)\n  - `utils`: add support for refcounted objects in generic array (gh#openSUSE/wicked#1045)\n","status":"published","published":"2026-08-27T12:21:23Z","modified":"2026-09-04T18:23:11.915963479Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3841-1","title":"Security update for wicked","description":"This update for wicked fixes the following issue:\n\n- CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum handling of DHCPv4 capture parsing \n  (bsc#1274627).\n- CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended beyond provided allocation in DHCPv4\n  capture parsing (bsc#1274627).\n","status":"published","published":"2026-08-27T12:21:39Z","modified":"2026-09-04T18:23:11.903099962Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3842-1","title":"Security update for wicked","description":"This update for wicked fixes the following issue:\n\n- CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum handling of DHCPv4 capture parsing \n  (bsc#1274627).\n- CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended beyond provided allocation in DHCPv4\n  capture parsing (bsc#1274627).\n","status":"published","published":"2026-08-27T12:22:40Z","modified":"2026-09-04T18:23:11.902998798Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}