CVE-2026-56116CWE-401

CVE-2026-56116

Medium · published June 23, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-06-23T21:17Z
Affected products (1)
ProductVersionsFixed in
dhcpcd_project/dhcpcd≥ 10.0.7, < 10.5.010.5.0
References (2)
https://github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0 · [email protected]https://www.vulncheck.com/advisories/dhcpcd-memory-leak-dos-via-ipv6-router-advertisement-handling · [email protected]
EPSS history
Timeline
  • 23 JUN 16:11Z
    dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling
    cvelistv5