Moderate Security Vulnerability in dhcpcd Package: Infinite Loop and Out-of-Bounds Read
Summary
RLSA-2026:54210: Moderate: dhcpcd security update. Affects dhcpcd versions < 0:10.0.6-11.el10_2. Fixed in 0:10.0.6-11.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dhcpcd package is a minimalistic network configuration daemon that facilitates both IPv4 and IPv6 configurations. It supports configuration discovery through protocols such as NDP, DHCPv4, and DHCPv6, making it essential for network management in various environments. However, it has been identified to have a security vulnerability that could lead to significant issues if not addressed promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2026-14258, arises from an infinite loop and an out-of-bounds read triggered by a zero-length IPv6 ND option in Router Advertisement handling. This flaw can potentially lead to denial of service, affecting the stability and availability of network services. The technical implications include the possibility of the daemon entering an infinite loop, which can consume system resources and disrupt normal operations.
How To Fix
Minimum fixed version
0:10.0.6-11.el10_2
This is the first release that contains the fix.
sudo dnf update dhcpcdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable IPv6 Router Advertisements if they are not required for their network configuration. This can be done by modifying the system's network settings or configuration files, depending on the specific environment.
Conclusion
The dhcpcd package has a moderate security vulnerability that can lead to significant network issues if not addressed. Users are advised to update to the latest patched version to mitigate risks. For real-time monitoring of vulnerabilities, consider using Vulert.
See every vulnerability recorded for dhcpcd →
FAQ
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
The vulnerability can lead to an infinite loop and out-of-bounds read, potentially causing denial of service and affecting network stability.
Yes, updating to the patched version of the dhcpcd package (0:10.0.6-11.el10_2) is the recommended permanent fix.
If immediate updates are not possible, consider disabling IPv6 Router Advertisements as a temporary workaround until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for dhcpcd.
