Dhcpcd Project Dhcpcd vulnerabilities

CVE-2019-11577 [CRITICAL] CWE-119 CVE-2019-11577: dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA address dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses.

CVE-2016-1503 [CRITICAL] CWE-119 CVE-2016-1503: dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, a dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages option lengths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a malformed DHCP response, aka internal bug 26461634.

CVE-2019-11766 [CRITICAL] CWE-125 CVE-2019-11766: dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCL dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature.

CVE-2012-2152 [HIGH] CVE-2012-2152: Stack-based buffer overflow in the get_packet method in socket Stack-based buffer overflow in the get_packet method in socket.c in dhcpcd 3.2.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long packet.

CVE-2012-6698 [HIGH] CWE-119 CVE-2012-6698: The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of s The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response.

CVE-2014-7912 [MEDIUM] CWE-119 CVE-2014-7912: The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5. The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a

CVE-2016-1504 [HIGH] CWE-119 CVE-2016-1504: dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) v dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to the option length.

CVE-2012-6700 [HIGH] CWE-119 CVE-2012-6700: The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which al The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP servers to cause a denial of service via a crafted response.

CVE-2012-6699 [HIGH] CWE-119 CVE-2012-6699: The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of s The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.

CVE-2014-7913 [MEDIUM] CWE-119 CVE-2014-7913: The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.

CVE-2019-11578 [MEDIUM] CWE-203 CVE-2019-11578: auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks. auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

CVE-2026-56114 [MEDIUM] CWE-787 CVE-2026-56114: dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulner dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTION_PD_EXCLUDE option body. Attackers can send a crafted DHCPv6 ADVERTISE message

CVE-2026-56113 [MEDIUM] CWE-416 CVE-2026-56113: dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that al dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dh

CVE-2026-56116 [MEDIUM] CWE-401 CVE-2026-56116: dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Rou dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information option

CVE-2019-11579 [MEDIUM] CWE-125 CVE-2019-11579: dhcp.c in dhcpcd before 7.2.1 contains a 1-byte read overflow with DHO_OPTSOVERLOADED. dhcp.c in dhcpcd before 7.2.1 contains a 1-byte read overflow with DHO_OPTSOVERLOADED.

CVE-2026-56117 [MEDIUM] CWE-416 CVE-2026-56117: dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket and send a privileged command such as -x, causing cont

CVE-2002-1403 [HIGH] CVE-2002-1403: dhcpcd DHCP client daemon 1 dhcpcd DHCP client daemon 1.3.22 and earlier allows local users to execute arbitrary code via shell metacharacters that are fed from a dhcpd .info script into a .exe script.

CVE-2005-1848 [MEDIUM] CVE-2005-1848: The dhcpcd DHCP client before 1 The dhcpcd DHCP client before 1.3.22 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors that cause an out-of-bounds memory read.

CVE-2014-6060 [LOW] CWE-399 CVE-2014-6060: The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DHO_OPTIONSOVERLOADED option in the (1) bootfile or (2) servername section, which triggers the option to be processed again.