Vulnerability · Published Jul 1, 2026 · Assigned by redhat
CVE-2026-14258Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling
Medium 6.5
In plain English
A medium-severity infinite loop in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | dhcpcd | 10.0.6-11.el10_2 | ALSA-2026:54210 |
| Debian:13 | dhcpcd | 1:10.1.0-11+deb13u4 | DEBIAN-CVE-2026-14258 |
| Debian:14 | dhcpcd | 1:10.2.4-3 | DEBIAN-CVE-2026-14258 |
| Rocky Linux:10 | dhcpcd | 0:10.0.6-11.el10_2 | RLSA-2026:54210 |
| Ubuntu:24.04:LTS | dhcpcd | no fix listed | UBUNTU-CVE-2026-14258 |
| Ubuntu:25.10 | dhcpcd | no fix listed | UBUNTU-CVE-2026-14258 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
Weakness: CWE-835 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2026:54210 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-14258 vdb-entry, x_refsource_REDHAT
- RHBZ#2462305 issue-tracking, x_refsource_REDHAT
- https://github.com/NetworkConfiguration/dhcpcd/commit/75289ca
- https://github.com/NetworkConfiguration/dhcpcd/issues/415