Medium [CVE-2026-56114] Denial of Service due to stack out-of-bounds write via crafted DHCPv6 message
This medium-severity Red Hat Linux advisory covers CVE-2026-56114 affecting Red Hat Enterprise Linux 10, Red Hat package: dhcpcd.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Summary
dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body.
Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory. A flaw was found in dhcpcd.
By sending a specially crafted DHCPv6 ADVERTISE message with an oversized option, the attacker can write beyond a buffer, potentially corrupting adjacent memory. This could lead to a denial of service.
Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-787.
Affected Red Hat products: Red Hat Enterprise Linux 10. Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: dhcpcd.
Is CVE-2026-56114 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-56114 is not in the CISA KEV catalog (checked ) and this advisory does not report exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-56114?
Upgrade to a fixed release named by Red Hat:
- 10.3.2
Confirm against the vendor advisory before you patch.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Mitigation checklist
- To mitigate this issue, restrict network access to systems running dhcpcd to trusted networks only. If DHCPv6 is not required, it can be disabled by configuring dhcpcd to ignore IPv6 or by disabling IPv6 on the network interfaces. Consult your system's network configuration documentation for specific instructions on disabling DHCPv6 for dhcpcd or network interfaces. A service restart may be required for changes to take effect.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
More Red Hat Linux advisories
- CVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-free
- CVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
- CVE-2026-119977Oct 31, 2026Arbitrary code execution via predictable upgrade staging paths
- CVE-2026-97229Oct 13, 2026integer overflow issue in CI/CD regular expression compiler
- CVE-2026-64849Aug 17, 2026Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed
iPhone and Android apps · New on the App Store
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.