Dhcpcd_project Dhcpcd
17 CVEs affecting Dhcpcd_project Dhcpcd. Latest disclosed: 2026-06-23. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11766 | Critical | 9.8 | 2019-05-05 | dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature. |
CVE-2019-11577 | Critical | 9.8 | 2019-04-28 | dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses. |
CVE-2016-1503 | Critical | 9.8 | 2016-04-18 | dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages opt… |
CVE-2026-56115 | High | 8.8 | 2026-06-23 | Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by expl… |
CVE-2016-1504 | High | 7.5 | 2017-02-07 | dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to the option length. |
CVE-2012-6700 | High | 7.5 | 2016-04-11 | The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP servers to cause a denial of service via a… |
CVE-2012-6699 | High | 7.5 | 2016-04-11 | The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response. |
CVE-2012-6698 | High | 7.5 | 2016-04-11 | The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response. |
CVE-2026-56116 | Medium | 6.5 | 2026-06-23 | dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an… |
CVE-2019-11578 | Medium | 5.9 | 2019-04-28 | auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks. |
CVE-2026-56114 | Medium | 5.3 | 2026-06-23 | dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dhcp6.c that allows u… |
CVE-2026-56113 | Medium | 5.3 | 2026-06-23 | dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemo… |
CVE-2019-11579 | Medium | 5.3 | 2019-04-28 | dhcp.c in dhcpcd before 7.2.1 contains a 1-byte read overflow with DHO_OPTSOVERLOADED. |
CVE-2026-56117 | Medium | 4.7 | 2026-06-23 | dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows lo… |
CVE-2014-7913 | | 2015-07-30 | The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the… | |
CVE-2014-7912 | | 2015-07-30 | The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship be… | |
CVE-2014-6060 | | 2014-09-04 | The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DHO_OPTIONSOVERLOADED… |