CVE-2026-56116

Publication date 23 June 2026

Last updated 24 September 2026

Ubuntu priority

Cvss 3 Severity Score

Description

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
dhcpcd	26.04 LTS resolute	Needs evaluation
	25.10 questing	Ignored end of life, was needs-triage
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not in release

Notes

mdeslaur

introduced in 10.0.7 by: https://github.com/NetworkConfiguration/dhcpcd/commit/f1cf924ad691bc1e6bf33013407fbf838fa40fbe

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
dhcpcd	Upstream: 708b4a5

Severity score breakdown

CVSS version:

Base score 7.1 · High

Base metrics

Parameter	Value
Attack vector	Adjacent
Attack complexity	Low
Attack requirements	None
Privileges required	None
User interaction	None
Vulnerable system - Confidentiality impact	None
Vulnerable system - Integrity impact	None
Vulnerable system - Availability impact	High
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	7.1 · High
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Base score 6.5 · Medium