CVE-2026-18103: Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi
A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the printhwaddr() function. Successful exploitation leads to a persistent denial of service (DoS), causing the dhcpd service to crash and preventing it from restarting without manual intervention.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18103?
The severity of CVE-2026-18103 is rated as medium with a score of 4.9.
How does CVE-2026-18103 affect dhcp-server?
CVE-2026-18103 can lead to a persistent denial of service in dhcp-server due to a buffer overflow via OMAPI.
How can I mitigate CVE-2026-18103?
To mitigate CVE-2026-18103, secure the OMAPI port with TSIG key authentication to prevent unauthorized access.
What types of attacks are possible with CVE-2026-18103?
A remote attacker could exploit CVE-2026-18103 by sending specially crafted lease creation requests to trigger a buffer overflow.
Is CVE-2026-18103 a critical vulnerability?
CVE-2026-18103 is not classified as critical, but it poses a medium risk due to its potential for denial of service.