Security Update for dhcpcd: Infinite Loop and Out-of-Bounds Read Vulnerability
Summary
ALSA-2026:54210: Moderate: dhcpcd security update. Affects dhcpcd versions < 10.0.6-11.el10_2. Fixed in 10.0.6-11.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dhcpcd package is a minimalistic network configuration daemon that facilitates both IPv4 and IPv6 configuration. It plays a crucial role in network management by supporting configuration discovery through protocols like NDP, DHCPv4, and DHCPv6. However, it has been identified to have a vulnerability that can lead to an infinite loop and out-of-bounds read, potentially compromising system stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2026-14258 arises from an infinite loop and out-of-bounds read triggered by a zero-length IPv6 ND option in Router Advertisement handling. This flaw can lead to denial of service conditions, where the dhcpcd daemon may become unresponsive, impacting network connectivity and overall system functionality. The technical implications of this vulnerability highlight the importance of proper input validation and handling in network configuration protocols.
How To Fix
Minimum fixed version
10.0.6-11.el10_2
This is the first release that contains the fix.
sudo dnf update dhcpcdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable IPv6 support in their network configuration until the package is updated. This can be done by modifying the network configuration files or using system settings to turn off IPv6.
Conclusion
The dhcpcd package has a critical vulnerability that requires immediate attention. By updating to the latest patched version, users can protect their systems from potential denial of service attacks. It is essential to stay informed about such vulnerabilities and utilize tools like Vulert to monitor and manage open-source software security.
See every vulnerability recorded for dhcpcd →
FAQ
dhcpcd is a network configuration daemon that manages both IPv4 and IPv6 settings, allowing devices to obtain network configurations automatically.
CVE-2026-14258 refers to a specific vulnerability in the dhcpcd package that can cause an infinite loop and out-of-bounds read due to improper handling of IPv6 ND options.
This vulnerability can lead to denial of service, causing the dhcpcd daemon to become unresponsive, which may disrupt network connectivity and affect applications relying on network access.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, consider disabling IPv6 support as a temporary workaround to mitigate the risk until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for dhcpcd.
