CVE-2026-55606 Details
Description
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
A stack buffer overread vulnerability has been identified in the OpenWrt odhcpd component, which serves as the DHCPv6, DHCPv4, and router-advertisement server. This vulnerability exists in versions through 25.12. The issue arises in the DHCPv6 self-loop detection mechanism, where a network-byte-order DUID length value is improperly used as the size parameter for the memcmp() function. On little-endian hosts, this mismanagement leads to a significant overread: a single unauthenticated DHCPv6 packet can cause a 2560-byte overread from a buffer that is only 128 bytes long.
Users can update to odhcpd version 25.12 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f | [email protected] | Source CodeVendor |
| https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301 | [email protected] | Source CodeVendor |
| https://github.com/openwrt/odhcpd/pull/401 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-126 | Buffer Over-read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| odhcpd | <= master (e432dd6) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |