Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-28T17:35:55 dhcp-server: dhcp-server: Persistent denial of service due to buffer overflow via OMAPI 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CWE-120

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.

This flaw has Moderate impact. A buffer overflow in the `dhcpd` service, exploitable via the OMAPI port (7911), can lead to a persistent denial of service. Exploitation requires network access to the OMAPI port, and if TSIG key authentication is not configured, no further credentials are needed. Successful exploitation crashes the `dhcpd` service, preventing its restart without manual intervention. This issue was discovered by Martin Osvald (Red Hat). To mitigate this issue, secure OMAPI access by configuring TSIG key authentication to prevent unauthorized connections to the OMAPI port (7911). If the `dhcpd` service has already crashed due to this flaw, manually remove the problematic InfiniBand lease entry from `/var/lib/dhcpd/dhcpd.leases` and then restart the `dhcpd` service. Restarting the `dhcpd` service may temporarily interrupt DHCP services for clients. Red Hat Enterprise Linux 6 Fix deferred dhcp Red Hat Enterprise Linux 7 Fix deferred dhcp Red Hat Enterprise Linux 8 Fix deferred dhcp Red Hat Enterprise Linux 9 Affected dhcp https://www.cve.org/CVERecord?id=CVE-2026-18103 https://nvd.nist.gov/vuln/detail/CVE-2026-18103