Description
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.
Published: 2026-10-12
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch or Upgrade
AI Analysis

Impact

A size_t underflow in odhcpd’s DHCPv6 IA handling permits an attacker to send crafted RENEW packets that overflow a 512‑byte stack buffer, thereby triggering the stack canary and terminating the DHCP server. The flaw does not permit code execution, but it repeatedly disrupts service as procd respawns the daemon, effectively denying DHCPv6 to clients on the same link.

Affected Systems

OpenWrt routers that run the odhcpd package before the patch incorporated in firmware release 25.12.5 are affected. Any build based on the older commit history referenced in the GitHub advisory—specifically commit cfddd56 and earlier—carries the vulnerability.

Risk and Exploitability

With a CVSS score of 6.5 the vulnerability is of moderate severity. No EPSS value is published and it is not listed in the CISA KEV catalog, yet it can be reached by any unauthenticated host on the same network segment. The lack of length checks allows an attacker to repeatedly send malicious DU packets, causing odhcpd to crash and forcing service re‑initialization, which is disruptive for environments that depend on continuous DHCPv6 availability.

Generated by OpenCVE AI on October 12, 2026 at 22:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the OpenWrt firmware to version 25.12.5 or later to obtain the patched odhcpd code.
  • If an immediate firmware update is not possible, apply the patch commits cited in the advisory to the odhcpd source before building or installing the package.
  • As a temporary measure, block or filter DHCPv6 RENEW traffic from untrusted hosts, or disable DHCPv6 on the affected device until a patch can be applied.

Generated by OpenCVE AI on October 12, 2026 at 22:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.
Title odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
Weaknesses CWE-121
CWE-191
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-12T21:31:24.809Z

Reserved: 2026-06-11T15:46:12.316Z

Link: CVE-2026-53922

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T22:17:04.623

Modified: 2026-10-12T22:17:04.623

Link: CVE-2026-53922

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T22:30:07Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow

  • CWE-191

    Integer Underflow (Wrap or Wraparound)