DEBIAN-CVE-2026-115863
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-115863
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115863.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-115863
- Upstream
- CVE-2026-115863
- Published
- 2026-10-23T18:17:21Z
- Modified
- 2026-10-24T13:00:06Z
- Severity
-
- 7.6 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
- Summary
- [none]
- Details
-
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.
- References
Affected packages
Debian:12 / connman
Package
- Name
- connman
- Purl
- pkg:deb/debian/connman?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / connman
Package
- Name
- connman
- Purl
- pkg:deb/debian/connman?arch=source&distro=trixie
Debian:14 / connman
Package
- Name
- connman
- Purl
- pkg:deb/debian/connman?arch=source&distro=forky