---
id: "CVE-2026-115863"
kind: "vulnerability"
aliases: ["CVE-2026-115863"]
title: "ConnMan: DHCPv6 reply overflows stack buffer, crashing connmand on-link"
severity: "high"
cvss: 7.6
epss: 0.00414
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["connman", "embedded", "iot", "linux", "network-manager", "runtime"]
not_affected_if: ["ipv6-dhcp-disabled", "isolated-link", "no-connman"]
published_at: "2026-10-23T18:17:21+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115863", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115863", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# ConnMan: DHCPv6 reply overflows stack buffer, crashing connmand on-link

ConnMan through 2.0 copies a DHCPv6 DOMAIN_LIST option into a fixed 1026-byte stack buffer without checking its length, then walks DNS labels past the end. An attacker on the same network link can send a forged Router Advertisement and DHCPv6 reply to crash connmand, which runs as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `connmand --version` and compare against the fixed release, which the sources do not name
- Check whether connman is installed and running with `systemctl status connman`
- Confirm the version includes commit bb06c47 or later, which the description says introduced the flaw

## Fix

- Move ConnMan to a release later than 2.0 that includes the fix for get_domains in gdhcp/client.c; the exact version is unknown from the sources
- Until patched, disable IPv6 DHCP client use on untrusted links if that is possible, which the sources do not confirm

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115863
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115863

## From the sources

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_