CVE-2026-14258CWE-835

CVE-2026-14258

Medium · published July 1, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.3th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-07-01T15:16Z
References (6)
https://access.redhat.com/errata/RHSA-2026:54210 · [email protected]https://access.redhat.com/security/cve/CVE-2026-14258 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2462305 · [email protected]https://github.com/NetworkConfiguration/dhcpcd/commit/75289ca · [email protected]https://github.com/NetworkConfiguration/dhcpcd/issues/415 · [email protected]https://github.com/NetworkConfiguration/dhcpcd/issues/415 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 JUL 09:24Z
    Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling
    cvelistv5