CVE-2026-56116

Name of the Vulnerable Software and Affected Versions dhcpcd versions prior to 10.3.2

Description An issue in the IPv6 Router Advertisement route information handling allows an unauthenticated attacker on the same link to cause a denial of service. By repeatedly sending crafted Router Advertisements containing Route Information options with a lifetime of zero, an attacker can trigger unfreed allocations in the routeinfo findalloc() function. This leads to linear memory exhaustion and an eventual crash of the daemon.

Recommendations Update to the version containing commit 708b4a5.