Refine your search
5 vulnerabilities found for odhcpd by openwrt
CVE-2026-55606 (GCVE-0-2026-55606)
Vulnerability from cvelistv5
Published
2026-10-23 13:21
Modified
2026-10-23 13:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-126 - Buffer Over-read
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c= 25.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd\u0027s DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer \u2014 a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126: Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:21:21.038Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45"
},
{
"name": "https://github.com/openwrt/odhcpd/pull/401",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/pull/401"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301"
}
],
"source": {
"advisory": "GHSA-x8x4-7gvf-gp45",
"discovery": "UNKNOWN"
},
"title": "odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55606",
"datePublished": "2026-10-23T13:21:21.038Z",
"dateReserved": "2026-06-16T23:31:22.445Z",
"dateUpdated": "2026-10-23T13:21:21.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53918 (GCVE-0-2026-53918)
Vulnerability from cvelistv5
Published
2026-10-23 13:21
Modified
2026-10-23 13:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.
References
| URL | Tags | |
|---|---|---|
{
"containers": {
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 25.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd\u0027s DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first-\u003ekey`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-672",
"description": "CWE-672: Operation on a Resource after Expiration or Release",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "CWE-825: Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:21:00.665Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9"
}
],
"source": {
"advisory": "GHSA-44ff-jcwh-wgc2",
"discovery": "UNKNOWN"
},
"title": "odhcpd DHCPv6 IA dangling first pointer use-after-free"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53918",
"datePublished": "2026-10-23T13:21:00.665Z",
"dateReserved": "2026-06-11T15:46:12.315Z",
"dateUpdated": "2026-10-23T13:21:00.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53920 (GCVE-0-2026-53920)
Vulnerability from cvelistv5
Published
2026-10-23 13:20
Modified
2026-10-23 20:58
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
References
| URL | Tags | |
|---|---|---|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T17:33:12.791918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T20:58:10.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003e= 17.01.0, \u003c 25.12.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd\u0027s DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia-\u003eiaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd\u0027s 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126: Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:20:48.045Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/719fc3abc0d7e7059871f9f572fb05ada86b8ff2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/719fc3abc0d7e7059871f9f572fb05ada86b8ff2"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/f2275efc72a87a95f971f159babcbadc5d241d42",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/f2275efc72a87a95f971f159babcbadc5d241d42"
}
],
"source": {
"advisory": "GHSA-p769-5v73-pc4f",
"discovery": "UNKNOWN"
},
"title": "odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53920",
"datePublished": "2026-10-23T13:20:48.045Z",
"dateReserved": "2026-06-11T15:46:12.316Z",
"dateUpdated": "2026-10-23T20:58:10.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53921 (GCVE-0-2026-53921)
Vulnerability from cvelistv5
Published
2026-10-23 13:20
Modified
2026-10-23 13:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-121 - Stack-based Buffer Overflow
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
References
{
"containers": {
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 25.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd\u0027s DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:20:30.249Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/0320032ae313452f3c8cb8725c621dd06c36dc03",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/0320032ae313452f3c8cb8725c621dd06c36dc03"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/03dacc23356b5789842b9d1bba0200fd005e35f3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/03dacc23356b5789842b9d1bba0200fd005e35f3"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/2a42d34c3615e2449ca273f673eee7c429d819a9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/2a42d34c3615e2449ca273f673eee7c429d819a9"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/6634b7a3c79c41a27687925c98c35c8aea2f2b5a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/6634b7a3c79c41a27687925c98c35c8aea2f2b5a"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328"
}
],
"source": {
"advisory": "GHSA-7fwx-hhrg-3496",
"discovery": "UNKNOWN"
},
"title": "odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53921",
"datePublished": "2026-10-23T13:20:30.249Z",
"dateReserved": "2026-06-11T15:46:12.316Z",
"dateUpdated": "2026-10-23T13:20:30.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53922 (GCVE-0-2026-53922)
Vulnerability from cvelistv5
Published
2026-10-12 21:31
Modified
2026-10-13 13:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53922",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:59:05.921605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:59:31.626Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c c6792bac3905d4bf726d914e9994f6d4b98c5b57"
}
]
},
{
"product": "openwrt",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 25.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T21:31:24.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/c6792bac3905d4bf726d914e9994f6d4b98c5b57",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/c6792bac3905d4bf726d914e9994f6d4b98c5b57"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d08dbcc527cb8f296cd132c1e5bca696e77095b8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d08dbcc527cb8f296cd132c1e5bca696e77095b8"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328"
},
{
"name": "https://github.com/openwrt/openwrt/releases/tag/v25.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/openwrt/releases/tag/v25.12.5"
}
],
"source": {
"advisory": "GHSA-7hcw-g2jh-pqv5",
"discovery": "UNKNOWN"
},
"title": "odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53922",
"datePublished": "2026-10-12T21:31:24.809Z",
"dateReserved": "2026-06-11T15:46:12.316Z",
"dateUpdated": "2026-10-13T13:59:31.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}