CVE-2026-124740 · Infrastructure
NO FIX YET
BusyBox's udhcpc6 DHCPv6 client can read freed heap memory when a DHCPv6 reply lacks usable address options. A malicious DHCPv6 server on the local network can crash the client or get previously assigned IPv6 address data disclosed in later requests.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems running BusyBox's udhcpc6 DHCPv6 client to configure IPv6 addresses on a network interface are exposed. The attacker must be a malicious DHCPv6 server on the same local network segment. Systems that do not use udhcpc6 for DHCPv6 can skip it.
Not affected if no-dhcpv6, no-udhcpc6, static-ipv6
Who cares busybox, dhcpv6, embedded-linux, ipv6
busybox --help or busybox | head -1udhcpc6 on the system, for example with which udhcpc6 or ls /sbin/udhcpc6No fix yet, per the sources.
A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests.
This page as .md · .json · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.