CVE-2026-18103 PUBLISHED

Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi

Assigner: redhat
Reserved: 28.07.2026 Published: 04.08.2026 Updated: 05.08.2026

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the print_hw_addr() function. Successful exploitation leads to a persistent denial of service (DoS), causing the dhcpd service to crash and preventing it from restarting without manual intervention.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 4.9

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected

Workarounds

To mitigate this issue, secure OMAPI access by configuring TSIG key authentication to prevent unauthorized connections to the OMAPI port (7911). If the dhcpd service has already crashed due to this flaw, manually remove the problematic InfiniBand lease entry from /var/lib/dhcpd/dhcpd.leases and then restart the dhcpd service. Restarting the dhcpd service may temporarily interrupt DHCP services for clients.

Credits

  • This issue was discovered by Martin Osvald (Red Hat).

References

Problem Types

  • Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE