Live › vulnerability › CVE-2026-115863
Go to dashboardConnMan through 2.0 copies a DHCPv6 DOMAIN_LIST option into a fixed 1026-byte stack buffer without checking its length, then walks DNS labels past the end. An attacker on the same network link can send a forged Router Advertisement and DHCPv6 reply to crash connmand, which runs as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running ConnMan 2.0 or earlier with the DHCPv6 client active on a link that an attacker can reach. Attacks need to be on the same link (Layer 2 adjacency) and do not need credentials. Systems that do not run ConnMan, or that run it only on fully trusted networks, carry less exposure.
No product ranges from the sources yet.
connmand --version and compare against the fixed release, which the sources do not namesystemctl status connmanEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.
This page as .md · .json · in your agent: get_signal("CVE-2026-115863")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.