CVE-2026-56116

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0	Patch
https://www.vulncheck.com/advisories/dhcpcd-memory-leak-dos-via-ipv6-router-advertisement-handling	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) dhcpcd hasta la versión 10.3.2, corregido en el commit 708b4a5, contiene una vulnerabilidad de fuga de memoria en el manejo de información de ruta de los anuncios de router IPv6 que permite a un atacante no autenticado en el mismo enlace causar una denegación de servicio mediante el envío de anuncios de router manipulados. Los atacantes pueden enviar repetidamente anuncios de router que contienen opciones de Información de Ruta con una vida útil de cero, desencadenando asignaciones no liberadas en routeinfo_findalloc() que causan un agotamiento lineal de la memoria y el eventual fallo del demonio.

Information

Published : 2026-06-23 17:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-56116

Mitre link : CVE-2026-56116

CVE.ORG link : CVE-2026-56116

JSON object : View

Products Affected

dhcpcd_project

dhcpcd

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2026-56116", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56116", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T17:00:12.933242Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/NetworkConfiguration/dhcpcd", "vendor": "NetworkConfiguration", "product": "dhcpcd", "versions": [{"status": "affected", "version": "10.0.7", "versionType": "semver", "lessThanOrEqual": "10.3.2"}, {"status": "unaffected", "version": "708b4a56bae080a5b18c2e0c4c6fbe103131a2b0", "versionType": "git"}], "packageURL": "pkg:github/NetworkConfiguration/dhcpcd", "defaultStatus": "affected"}]}], "published": "2026-06-23T17:17:09.410", "references": [{"url": "https://github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dhcpcd-memory-leak-dos-via-ipv6-router-advertisement-handling", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash."}, {"lang": "es", "value": "dhcpcd hasta la versi\u00f3n 10.3.2, corregido en el commit 708b4a5, contiene una vulnerabilidad de fuga de memoria en el manejo de informaci\u00f3n de ruta de los anuncios de router IPv6 que permite a un atacante no autenticado en el mismo enlace causar una denegaci\u00f3n de servicio mediante el env\u00edo de anuncios de router manipulados. Los atacantes pueden enviar repetidamente anuncios de router que contienen opciones de Informaci\u00f3n de Ruta con una vida \u00fatil de cero, desencadenando asignaciones no liberadas en routeinfo_findalloc() que causan un agotamiento lineal de la memoria y el eventual fallo del demonio."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DED2926-227C-45E4-8D4B-65505BFF5017", "versionEndExcluding": "10.5.0", "versionStartIncluding": "10.0.7"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}