Riskcovery

CVE-2026-56116

dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling

State
Published
Severity
7.1 High
Published
Jun 23, 2026
Updated
Jul 28, 2026
Reserved
Jun 18, 2026

Read the record on cve.org

Description

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.

Scores

CVSSScoreVectorSource
4.07.1 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NVulnCheck
3.16.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HVulnCheck

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
dhcpcdNetworkConfiguration
  • 10.0.7 through 10.3.2Affected
  • 708b4a56bae080a5b18c2e0c4c6fbe103131a2b0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.