Skip to content
OpenAdvisories
Medium WID-SEC-2026-2046 5 CVEs

dhcpcd: Mehrere Schwachstellen ermöglichen Denial of Service

Published Jun 23, 2026 · Updated Oct 29, 2026 · Revision 7 · de-DE

Vendor: Debian Vendor: Fedora Vendor: SUSE Product: Linux Product: Linux Product: Linux Product: openSUSE

Summary

Ein Angreifer kann mehrere Schwachstellen in dhcpcd ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

dhcpcd ist ein DHCP Client.

Vulnerabilities 5

  • High 8.8
    CVE-2026-56115

    Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass

    Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which valida…

    garybowers bootimus dhcpcd Ubuntu
  • Medium 6.5
    CVE-2026-56116

    dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling

    dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertiseme…

    NetworkConfiguration dhcpcd dhcpcd dhcpcd Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-56113

    dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW

    dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and vali…

    NetworkConfiguration dhcpcd dhcpcd dhcpcd Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-56114

    dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()

    dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized …

    NetworkConfiguration dhcpcd dhcpcd dhcpcd5 Debian Ubuntu Azure Linux Alpine
  • Medium 4.7
    CVE-2026-56117

    dhcpcd Heap Use-After-Free via Control Socket Handling

    dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attac…

    NetworkConfiguration dhcpcd dhcpcd dhcpcd Debian Ubuntu Azure Linux Alpine

Revision history

  1. #7

    Neue Updates von Fedora aufgenommen

  2. #6

    Neue Updates von SUSE aufgenommen

  3. #5

    Neue Updates von SUSE aufgenommen

  4. #4

    Neue Updates von openSUSE aufgenommen

  5. #3

    Neue Updates von openSUSE aufgenommen

  6. #2

    Neue Updates von Debian aufgenommen

  7. #1

    Initiale Fassung

References