{"id":"GO-2026-6237","aliases":[],"status":"published","title":"Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp","description":"In github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in a negative DHCP length, causing a panic in buf.Consume due to a negative slice bound.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-18T16:38:10Z","modified":"2026-08-19T15:41:56Z","fixes":[{"ecosystem":"Go","package":"github.com/insomniacslk/dhcp","fixed_in":["0.0.0-20260719225207-c76316d4aa82"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Go","package":"github.com/insomniacslk/dhcp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260719225207-c76316d4aa82"}]}]}],"references":[{"url":"https://github.com/insomniacslk/dhcp/commit/c76316d4aa825673b208730779843d0711021e81","tags":["fix"]}],"sources":{"osv":[{"id":"GO-2026-6237","title":"Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp","description":"In github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in a negative DHCP length, causing a panic in buf.Consume due to a negative slice bound.","status":"published","published":"2026-08-18T16:38:10Z","modified":"2026-08-19T15:41:56.905027993Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}