Bug 2508081 (CVE-2026-18103) - CVE-2026-18103 dhcp-server: dhcp-server: Persistent denial of service due to buffer overflow via OMAPI
Summary: CVE-2026-18103 dhcp-server: dhcp-server: Persistent denial of service due to ...
Keywords:
Status: NEW
Alias: CVE-2026-18103
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-28 17:40 UTC by Patrick Del Bello
Modified: 2026-08-19 19:19 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Patrick Del Bello 2026-07-28 17:40:38 UTC
A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.


Note You need to log in before you can comment on or make changes to this bug.