PT-2026-51565
CVE-2026-56116
·
Published
2026-06-23
·
Updated
2026-10-08
Description by
CVSS 4.0
7.1
HighMetricsAV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
dhcpcd versions prior to 10.3.2
Description
An issue in the IPv6 Router Advertisement route information handling allows an unauthenticated attacker on the same link to cause a denial of service. By repeatedly sending crafted Router Advertisements containing Route Information options with a lifetime of zero, an attacker can trigger unfreed allocations in the
routeinfo findalloc() function. This leads to linear memory exhaustion and an eventual crash of the daemon.Recommendations
Update to the version containing commit 708b4a5.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾