CVE-2026-18103

Summary

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the print_hw_addr() function. Successful exploitation leads to a persistent denial of service (DoS), causing the dhcpd service to crash and preventing it from restarting without manual intervention.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Workarounds

To mitigate this issue, secure OMAPI access by configuring TSIG key authentication to prevent unauthorized connections to the OMAPI port (7911). If the dhcpd service has already crashed due to this flaw, manually remove the problematic InfiniBand lease entry from /var/lib/dhcpd/dhcpd.leases and then restart the dhcpd service. Restarting the dhcpd service may temporarily interrupt DHCP services for clients.

References