CVE-2026-18103

Name of the Vulnerable Software and Affected Versions dhcp-server (affected versions not specified)

Description A flaw in the Open Management Application Programming Interface (OMAPI) port allows a remote attacker to cause a persistent denial of service (DoS). By sending a specially crafted lease creation request containing an excessively long InfiniBand MAC address, a buffer overflow is triggered in the print hw addr() function. This results in the dhcpd service crashing and failing to restart without manual intervention. The risk is higher if the port is not secured with Transaction Signature (TSIG) key authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Secure the OMAPI port using TSIG key authentication to prevent unauthorized requests.