Skip to content
OpenAdvisories
Medium ALSA-2026:54210 1 CVE

Moderate: dhcpcd security update

Published Aug 12, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The dhcpcd package provides a minimalistic network configuration daemon that supports IPv4 and IPv6 configuration including configuration discovery through NDP, DHCPv4 and DHCPv6 protocols.

Security Fix(es):

* dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length IPv6 ND option in Router Advertisement handling (CVE-2026-14258)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 10 dhcpcd 10.0.6-11.el10_2

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-14258

    Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling

    A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without ad…

    Red Hat Red Hat Enterprise Linux 10 dhcpcd dhcpcd Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-14258
  • report
    https://bugzilla.redhat.com/2462305
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-54210.html