CVE-2026-56116: dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-401

Description

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.

Affected products

NetworkConfiguration dhcpcd: from 10.0.7 before 10.5.0 — fixed in 10.5.0

How to fix

Upgrade to a fixed version: NetworkConfiguration dhcpcd 10.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-56116 or the next vulnerability affects your stack