CVE-2026-56116

Medium

Description

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.

SeverityMedium

CVSS6.5

Exploit probability—

ProductDhcpcd

PublishedJun 23, 2026

First seenJun 23, 2026

Weakness typeCWE-401CWE-401

How to fix

Update

dhcpcd_project dhcpcd10.5.0 or later

Patches

github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0

Affected products

Product	Affected versions	Fixed in
dhcpcd_project dhcpcd	10.0.7 ≤ v < 10.5.0	10.5.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.