Vulnerability-Lookup

OPENSUSE-SU-2026:11473-1

Vulnerability from csaf_opensuse - Published: 2026-08-09 00:00 - Updated: 2026-08-09 00:00

Summary

dhcpcd-10.5.0-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: dhcpcd-10.5.0-1.1 on GA media

Description of the patch: These are all security issues fixed in the dhcpcd-10.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11473

CVE-2026-56113

5.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-56115

5.9 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-56116

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-56117

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

14 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-56113/	self
https://www.suse.com/security/cve/CVE-2026-56115/	self
https://www.suse.com/security/cve/CVE-2026-56116/	self
https://www.suse.com/security/cve/CVE-2026-56117/	self
https://www.suse.com/security/cve/CVE-2026-56113	external
https://bugzilla.suse.com/1268980	external
https://www.suse.com/security/cve/CVE-2026-56115	external
https://bugzilla.suse.com/1268976	external
https://www.suse.com/security/cve/CVE-2026-56116	external
https://bugzilla.suse.com/1268974	external
https://www.suse.com/security/cve/CVE-2026-56117	external
https://bugzilla.suse.com/1268968	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "dhcpcd-10.5.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the dhcpcd-10.5.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11473",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11473-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56113 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56113/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56115 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56115/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56116 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56116/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56117 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56117/"
      }
    ],
    "title": "dhcpcd-10.5.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-08-09T00:00:00Z",
      "generator": {
        "date": "2026-08-09T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11473-1",
      "initial_release_date": "2026-08-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-09T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dhcpcd-10.5.0-1.1.aarch64",
                "product": {
                  "name": "dhcpcd-10.5.0-1.1.aarch64",
                  "product_id": "dhcpcd-10.5.0-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dhcpcd-10.5.0-1.1.ppc64le",
                "product": {
                  "name": "dhcpcd-10.5.0-1.1.ppc64le",
                  "product_id": "dhcpcd-10.5.0-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dhcpcd-10.5.0-1.1.s390x",
                "product": {
                  "name": "dhcpcd-10.5.0-1.1.s390x",
                  "product_id": "dhcpcd-10.5.0-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dhcpcd-10.5.0-1.1.x86_64",
                "product": {
                  "name": "dhcpcd-10.5.0-1.1.x86_64",
                  "product_id": "dhcpcd-10.5.0-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dhcpcd-10.5.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64"
        },
        "product_reference": "dhcpcd-10.5.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dhcpcd-10.5.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le"
        },
        "product_reference": "dhcpcd-10.5.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dhcpcd-10.5.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x"
        },
        "product_reference": "dhcpcd-10.5.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dhcpcd-10.5.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
        },
        "product_reference": "dhcpcd-10.5.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56113",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56113"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56113",
          "url": "https://www.suse.com/security/cve/CVE-2026-56113"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268980 for CVE-2026-56113",
          "url": "https://bugzilla.suse.com/1268980"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56113"
    },
    {
      "cve": "CVE-2026-56115",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56115"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56115",
          "url": "https://www.suse.com/security/cve/CVE-2026-56115"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268976 for CVE-2026-56115",
          "url": "https://bugzilla.suse.com/1268976"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56115"
    },
    {
      "cve": "CVE-2026-56116",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56116"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56116",
          "url": "https://www.suse.com/security/cve/CVE-2026-56116"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268974 for CVE-2026-56116",
          "url": "https://bugzilla.suse.com/1268974"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56116"
    },
    {
      "cve": "CVE-2026-56117",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56117"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
          "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56117",
          "url": "https://www.suse.com/security/cve/CVE-2026-56117"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268968 for CVE-2026-56117",
          "url": "https://bugzilla.suse.com/1268968"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.aarch64",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.ppc64le",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.s390x",
            "openSUSE Tumbleweed:dhcpcd-10.5.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56117"
    }
  ]
}

CVE-2026-56113 (GCVE-0-2026-56113)

Vulnerability from cvelistv5 – Published: 2026-06-23 16:05 – Updated: 2026-07-28 01:49 X_Open Source

Title

dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW

Summary

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 17:58 UTC

CWE

CWE-416 - Use After Free

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/NetworkConfiguration/dhcpcd/co…	patch
https://www.vulncheck.com/advisories/dhcpcd-heap-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
NetworkConfiguration	dhcpcd	Affected: 0 , ≤ 10.3.2 (semver) Unaffected: 5733d3c59a5651f64357ac11c98b4f39895c8d25 (git)

Date Public

2026-06-22 00:00

Credits

CuB3y0nd VulnCheck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:58:06.379364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:58:21.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/NetworkConfiguration/dhcpcd",
          "product": "dhcpcd",
          "repo": "https://github.com/NetworkConfiguration/dhcpcd",
          "vendor": "NetworkConfiguration",
          "versions": [
            {
              "lessThanOrEqual": "10.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5733d3c59a5651f64357ac11c98b4f39895c8d25",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "10.3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "CuB3y0nd"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "VulnCheck"
        }
      ],
      "datePublic": "2026-06-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:49:41.785Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/NetworkConfiguration/dhcpcd/commit/5733d3c59a5651f64357ac11c98b4f39895c8d25"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dhcpcd-heap-use-after-free-in-dhcp6-deprecateaddrs-via-dhcpv6-renew"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56113",
    "datePublished": "2026-06-23T16:05:59.768Z",
    "dateReserved": "2026-06-18T19:15:10.650Z",
    "dateUpdated": "2026-07-28T01:49:41.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56115 (GCVE-0-2026-56115)

Vulnerability from cvelistv5 – Published: 2026-06-23 16:08 – Updated: 2026-07-28 01:49 X_Open Source

Title

Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass

Summary

Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 17:07 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/garybowers/bootimus/issues/84	technical-descriptionexploit
https://www.vulncheck.com/advisories/bootimus-bro…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
garybowers	bootimus	Affected: 0 , ≤ 0.1.70 (semver)

Date Public

2026-06-25 00:00

Credits

djnn

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56115",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:07:56.273135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:08:40.406Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/garybowers/bootimus",
          "product": "bootimus",
          "repo": "https://github.com/garybowers/bootimus",
          "vendor": "garybowers",
          "versions": [
            {
              "lessThanOrEqual": "0.1.70",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:bootimus:bootimus:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.1.70",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "djnn"
        }
      ],
      "datePublic": "2026-06-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:49:43.199Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://github.com/garybowers/bootimus/issues/84"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bootimus-broken-access-control-via-jwtmiddleware-authorization-bypass"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56115",
    "datePublished": "2026-06-23T16:08:55.358Z",
    "dateReserved": "2026-06-18T19:15:10.650Z",
    "dateUpdated": "2026-07-28T01:49:43.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56116 (GCVE-0-2026-56116)

Vulnerability from cvelistv5 – Published: 2026-06-23 16:11 – Updated: 2026-07-28 01:49 X_Open Source

Title

dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling

Summary

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 17:00 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/NetworkConfiguration/dhcpcd/co…	patch
https://www.vulncheck.com/advisories/dhcpcd-memor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
NetworkConfiguration	dhcpcd	Affected: 10.0.7 , ≤ 10.3.2 (semver) Unaffected: 708b4a56bae080a5b18c2e0c4c6fbe103131a2b0 (git)

Date Public

2026-06-22 00:00

Credits

CuB3y0nd VulnCheck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56116",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:00:12.933242Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:03:00.129Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/NetworkConfiguration/dhcpcd",
          "product": "dhcpcd",
          "repo": "https://github.com/NetworkConfiguration/dhcpcd",
          "vendor": "NetworkConfiguration",
          "versions": [
            {
              "lessThanOrEqual": "10.3.2",
              "status": "affected",
              "version": "10.0.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "708b4a56bae080a5b18c2e0c4c6fbe103131a2b0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "10.3.2",
                  "versionStartIncluding": "10.0.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "CuB3y0nd"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "VulnCheck"
        }
      ],
      "datePublic": "2026-06-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:49:43.887Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dhcpcd-memory-leak-dos-via-ipv6-router-advertisement-handling"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56116",
    "datePublished": "2026-06-23T16:11:52.661Z",
    "dateReserved": "2026-06-18T19:15:10.651Z",
    "dateUpdated": "2026-07-28T01:49:43.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56117 (GCVE-0-2026-56117)

Vulnerability from cvelistv5 – Published: 2026-06-23 16:14 – Updated: 2026-07-28 01:49 X_Open Source

Title

dhcpcd Heap Use-After-Free via Control Socket Handling

Summary

dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666.

Severity

5.7 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-24 13:43 UTC

CWE

CWE-416 - Use After Free

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/NetworkConfiguration/dhcpcd/co…	patch
https://www.vulncheck.com/advisories/dhcpcd-heap-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
NetworkConfiguration	dhcpcd	Affected: 0 , ≤ 10.3.2 (semver) Unaffected: 78ea09ed1633a583dbcde6e7bab9df4639ec8a34 (git)

Date Public

2026-06-22 00:00

Credits

CuB3y0nd VulnCheck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56117",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-24T13:43:04.591782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T13:43:25.658Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/NetworkConfiguration/dhcpcd",
          "product": "dhcpcd",
          "repo": "https://github.com/NetworkConfiguration/dhcpcd",
          "vendor": "NetworkConfiguration",
          "versions": [
            {
              "lessThanOrEqual": "10.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "78ea09ed1633a583dbcde6e7bab9df4639ec8a34",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "10.3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "CuB3y0nd"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "VulnCheck"
        }
      ],
      "datePublic": "2026-06-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing control_recvdata() to free the client object while the same READ+HANGUP event subsequently reaches control_hangup() with the stale pointer, resulting in a use-after-free condition exploitable in deployments using --disable-privsep or where privsep initialization has failed with the control socket operating in mode 0666."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:49:44.651Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/NetworkConfiguration/dhcpcd/commit/78ea09ed1633a583dbcde6e7bab9df4639ec8a34"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dhcpcd-heap-use-after-free-via-control-socket-handling"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "dhcpcd Heap Use-After-Free via Control Socket Handling",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56117",
    "datePublished": "2026-06-23T16:14:31.918Z",
    "dateReserved": "2026-06-18T19:15:10.651Z",
    "dateUpdated": "2026-07-28T01:49:44.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

OPENSUSE-SU-2026:11473-1

CVE-2026-56113 (GCVE-0-2026-56113)

CVE-2026-56115 (GCVE-0-2026-56115)

CVE-2026-56116 (GCVE-0-2026-56116)

CVE-2026-56117 (GCVE-0-2026-56117)

Tags

Sightings

Nomenclature