CVE-2026-53920

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IANA or IAPD option whose body is shorter than struct dhcpv6iahdr, casts the option header to that full structure, and reads ia-iaid...

CVE-2026-53920

The odhcpd DHCPv6, DHCPv4, and router-advertisement server (used by OpenWrt ) is vulnerable to a stack disclosure in versions 17.01.0 through before 25.12.3 . The vulnerability exists because the DHCPv6 IA parser accepts IA_NA or IA_PD options with bodies shorter than the expected struct dhcpv6_i...

CVE-2026-53920 odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IANA or IAPD option whose body is shorter than struct dhcpv6iahdr, casts the option header to that full structure, and reads ia-iaid...

CVE-2026-53920 odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IANA or IAPD option whose body is shorter than struct dhcpv6iahdr, casts the option header to that full structure, and reads ia-iaid...

CVE-2026-53920 odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IANA or IAPD option whose body is shorter than struct dhcpv6iahdr, casts the option header to that full structure, and reads ia-iaid...

EUVD-2026-97968

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IANA options. ...

CVE-2026-53922

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IANA options. ...

CVE-2026-53922: Stack-based Buffer Overflow

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IANA options. ...

SUSE-SU-2026:20037-1 Security update for ovmf

This update for ovmf fixes the following issues: - CVE-2023-45229: integer underflow and out-of-bounds read when processing IANA/IATA options in a DHCPv6 Advertise message bsc1218879. - CVE-2023-45230: out-of-bounds write in the DHCPv6 client through a long Server ID option bsc1218880...

AZL-39436 CVE-2023-45229 affecting package hvloader for versions less than 1.0.1-9

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IANA or IATA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2015-0708: Undefined Security Weakness

Cisco IOS 15.4S, 15.4SN, and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service device crash by including an IANA option in a DHCPv6 Solicit message on the local network, aka Bug ID CSCur29956...

CVE-2007-5031

The TSrvOptIANA::rebind method in SrvOptions/SrvOptIANA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service NULL dereference and daemon crash via an invalid IANA option in a REBIND message...

Design/Logic Flaw

The TSrvOptIANA::rebind method in SrvOptions/SrvOptIANA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service NULL dereference and daemon crash via an invalid IANA option in a REBIND message...

CVE-2007-5031

The TSrvOptIANA::rebind method in SrvOptions/SrvOptIANA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service NULL dereference and daemon crash via an invalid IANA option in a REBIND message...

CVE-2007-5031

The TSrvOptIANA::rebind method in SrvOptions/SrvOptIANA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service NULL dereference and daemon crash via an invalid IANA option in a REBIND message...