CVE-2026-14258

Description

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

• How can I get the fixes?
• What do statuses mean?

Severity score breakdown

CVSS version: CVSS v3.0

References

• MITRE
• NVD
• Launchpad
• Debian

Other references

• https://www.cve.org/CVERecord?id=CVE-2026-14258
• https://access.redhat.com/security/cve/CVE-2026-14258
• https://bugzilla.redhat.com/show_bug.cgi?id=2462305
• https://github.com/NetworkConfiguration/dhcpcd/commit/75289ca
• https://github.com/NetworkConfiguration/dhcpcd/issues/415