CVE-2026-18103

The record

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.

Affected packages

Related vulnerabilities

• CVE-2026-80186 A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol… CWE-120
• CVE-2026-48706 Envoy is an open source edge and service proxy designed for cloud-native applications. CWE-120
• CVE-2026-57874 An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in… CWE-120
• CVE-2026-6681 The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz)… CWE-120
• CVE-2026-12246 NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength… CWE-120
• CVE-2026-42450 OpenColorIO is a color management framework for visual effects and animation. CWE-120
• CVE-2026-54257 Electron is a framework for writing cross-platform desktop applications using JavaScript… CWE-120
• CVE-2026-12806 A vulnerability has been found in Edimax BR-6478AC V2 1.23. CWE-120