{"id":"CVE-2026-115863","kind":"vulnerability","aliases":["CVE-2026-115863"],"related":[],"title":"ConnMan: DHCPv6 reply overflows stack buffer, crashing connmand on-link","description":"ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded \"c += jump + 1\" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.","summary":"ConnMan through 2.0 copies a DHCPv6 DOMAIN_LIST option into a fixed 1026-byte stack buffer without checking its length, then walks DNS labels past the end. An attacker on the same network link can send a forged Router Advertisement and DHCPv6 reply to crash connmand, which runs as root.","severity":"high","cvss":7.6,"epss":0.00414,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["connman","embedded","iot","linux","network-manager","runtime"],"not_affected_if":["ipv6-dhcp-disabled","isolated-link","no-connman"],"how_to_check":"- Run `connmand --version` and compare against the fixed release, which the sources do not name\n- Check whether connman is installed and running with `systemctl status connman`\n- Confirm the version includes commit bb06c47 or later, which the description says introduced the flaw","fix":"- Move ConnMan to a release later than 2.0 that includes the fix for get_domains in gdhcp/client.c; the exact version is unknown from the sources\n- Until patched, disable IPv6 DHCP client use on untrusted links if that is possible, which the sources do not confirm","status":"open","published_at":"2026-10-23T18:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:14:16+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:14:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move ConnMan to a release later than 2.0 that includes the fix for get_domains in gdhcp/client.c; the exact version is unknown from the sources\n- Until patched, disable IPv6 DHCP client use on untrusted links if that is possible, which the sources do not confirm","reach":"network","title":"ConnMan: DHCPv6 reply overflows stack buffer, crashing connmand on-link","impact":"medium","summary":"ConnMan through 2.0 copies a DHCPv6 DOMAIN_LIST option into a fixed 1026-byte stack buffer without checking its length, then walks DNS labels past the end. An attacker on the same network link can send a forged Router Advertisement and DHCPv6 reply to crash connmand, which runs as root.","category":"runtime","nicknames":[],"who_cares":["connman","linux","embedded","iot","network-manager"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated on-link crash of connmand running as root","analyst_note":"Find the fixed ConnMan release and the exact fix commit from the NVD entry or the ConnMan project; the sources give no fixed version.","how_to_check":"- Run `connmand --version` and compare against the fixed release, which the sources do not name\n- Check whether connman is installed and running with `systemctl status connman`\n- Confirm the version includes commit bb06c47 or later, which the description says introduced the flaw","needs_analyst":true,"not_affected_if":["no-connman","isolated-link","ipv6-dhcp-disabled"],"who_is_affected":"Systems running ConnMan 2.0 or earlier with the DHCPv6 client active on a link that an attacker can reach. Attacks need to be on the same link (Layer 2 adjacency) and do not need credentials. Systems that do not run ConnMan, or that run it only on fully trusted networks, carry less exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":3558,"output_tokens":691,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115863':14A,17A '-2026':13A,16A '1':137C,187C '1025':104C,149C '1026':38B,116C '2.0':28B,78C '24':112C 'actual':125C 'advertis':65B,185C 'attack':54B,168C,175C 'attacker-chosen':167C 'authent':180C 'base':83C 'bb06c47':217C 'buffer':6A,41B,84C,119C,160C 'byte':39B,105C,117C,153C 'c':135C 'check':43B 'chosen':169C 'connman':1A,18B,26B,76C 'connmand':8A,71B,209C 'copi':29B,99C 'craft':140C 'crash':7A,70B,207C 'cve':12A,15A 'dhcpv6':2A,31B,67B,88C,108C,141C,191C 'dns':48B,120C,130C 'domain':32B,95C,109C,145C,198C 'embed':19B 'end':52B,165C 'fix':37B,101C 'forg':63B,183C,190C 'gdhcp/client.c':97C 'get':94C 'impact':201C 'introduc':215C 'iot':20B 'jump':136C 'label':49B,131C,156C 'leav':158C 'length':45B,127C 'link':11A,59B,174C,206C 'linux':21B 'list':33B,110C,146C,199C 'long':197C 'loop':138C 'make':154C 'manag':24B 'match':193C 'maxdnam':103C 'messag':90C 'name':121C 'network':23B,58B 'network-manag':22B 'non':151C 'non-zero':150C 'ns':102C 'o':186C 'occur':92C 'on-link':9A,172C,204C 'option':34B,111C,126C,147C 'overflow':4A,85C 'past':50B,163C 'read/write':162C 'regardless':122C 'repli':3A,68B,89C,142C,192C 'root':75B,212C 'router':64B,184C 'run':73B,210C 'runtim':25B 'send':61B 'stack':5A,40B,82C,118C 'stack-bas':81C 'stride':170C 'trigger':177C 'unauthent':203C 'unbound':134C 'valu':113C 'via':86C,181C 'walk':47B,129C,157C 'without':42B,179C 'xid/clientid':194C 'zero':152C","nicknames":[],"mitigations":[],"who_affected":"Systems running ConnMan 2.0 or earlier with the DHCPv6 client active on a link that an attacker can reach. Attacks need to be on the same link (Layer 2 adjacency) and do not need credentials. Systems that do not run ConnMan, or that run it only on fully trusted networks, carry less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T18:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115863","severity":null,"published_at":"2026-10-23T18:17:21+00:00","modified_at":"2026-10-23T19:43:46+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115863","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115863","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}