DEBIAN-CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

EUVD-2026-109113

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

Versions of ConnMan through 2.0 are vulnerable to a stack-based buffer overflow in the get_domains function located in gdhcp/client.c. The flaw occurs because the software copies a fixed 1025 bytes from a DHCPv6 DOMAIN_LIST (option 24) into a 1026-byte stack buffer regardless of the actual option...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-98853

A flaw was found in the Linux kernel's Generic Segmentation Offload GSO implementation. When processing deeply nested IP-in-IP packets, recursive segmentation is not properly restricted, which can exhaust kernel stack memory. A remote attacker could exploit this vulnerability by transmitting...

CVE-2026-53921

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer pdbuf when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two...

When It Makes Sense to Replace a Legacy Virtualization Stack

Virtualization platforms often remain in place long after their original purpose because migration carries operational risk. Yet aging…...

CVE-2026-55606 odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp size parameter. On little-endian hosts, this causes memcmp to read far...

CVE-2026-55606

The odhcpd server, used by OpenWrt in versions 25.12 and prior , is vulnerable to a stack buffer overread due to a DUID length endianness mismatch in dhcpv6.c:720. On little-endian hosts , the software uses a network-byte-order DUID length value directly as a memcmp() size parameter, allowing a s...

CVE-2026-55606 odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp size parameter. On little-endian hosts, this causes memcmp to read far...

CVE-2026-53920

The odhcpd DHCPv6, DHCPv4, and router-advertisement server (used by OpenWrt ) is vulnerable to a stack disclosure in versions 17.01.0 through before 25.12.3 . The vulnerability exists because the DHCPv6 IA parser accepts IA_NA or IA_PD options with bodies shorter than the expected struct dhcpv6_i...

CVE-2026-53920 odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IANA or IAPD option whose body is shorter than struct dhcpv6iahdr, casts the option header to that full structure, and reads ia-iaid...

CVE-2026-53920

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IANA or IAPD option whose body is shorter than struct dhcpv6iahdr, casts the option header to that full structure, and reads ia-iaid...

CVE-2026-53920 odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IANA or IAPD option whose body is shorter than struct dhcpv6iahdr, casts the option header to that full structure, and reads ia-iaid...

EUVD-2026-108968

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IANA or IAPD option whose body is shorter than struct dhcpv6iahdr, casts the option header to that full structure, and reads ia-iaid...

CVE-2026-53920 odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IANA or IAPD option whose body is shorter than struct dhcpv6iahdr, casts the option header to that full structure, and reads ia-iaid...