CVE-2026-56116

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-401"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56116.json"
}

References

Affected packages

Git / github.com/networkconfiguration/dhcpcd

Affected ranges

Type

GIT

Repo

https://github.com/networkconfiguration/dhcpcd

Events

Introduced

3067b38dc867ede9967375c83ea01fb95f237941

Fixed

1d608519abb398006b77f11c7b720147adf4cfcc

Fixed

708b4a56bae080a5b18c2e0c4c6fbe103131a2b0

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:dhcpcd_project:dhcpcd:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "10.0.7"
                },
                {
                    "fixed":  "10.5.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "708b4a56bae080a5b18c2e0c4c6fbe103131a2b0"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v10.*

v10.0.10

v10.0.7

v10.0.8

v10.0.9

v10.1.0

v10.2.0

v10.2.1

v10.2.2

v10.2.3

v10.2.4

v10.3.0

v10.3.1

v10.3.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56116.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "147220208220241771676475277637298184653",
            "length":  3337
        },
        "id":  "CVE-2026-56116-229095a6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/networkconfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0",
        "target":  {
            "file":  "src/ipv6nd.c",
            "function":  "ipv6nd_expirera"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "126462191768933859182625905064871798288",
                "84695921800275119134825809965024024465",
                "312500445576796603602710037254256645037",
                "199358609586216563177532641102698207107"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-56116-2852a25f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/networkconfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0",
        "target":  {
            "file":  "src/ipv6nd.c"
        }
    }
]

vanir_signatures_modified

"2026-10-24T15:05:14Z"