{"id":"CVE-2026-55606","kind":"vulnerability","aliases":["CVE-2026-55606"],"related":[],"title":"OpenWrt odhcpd: one DHCPv6 packet over-reads stack memory","description":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.","summary":"odhcpd, the DHCPv6/DHCPv4/router-advertisement server used by OpenWrt, reads a length field in network byte order as a native integer during DHCPv6 self-loop detection. On little-endian hosts a single unauthenticated DHCPv6 packet makes memcmp() read about 2560 bytes past a 128-byte stack buffer.","severity":"medium","cvss":6.5,"epss":0.00474,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcpv6","infrastructure","openwrt","routers","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- `opkg list-installed | grep odhcpd` to see the installed odhcpd version\n- Check the OpenWrt release with `cat /etc/openwrt_release`; the sources say versions 25.12 and prior are affected\n- Confirm whether DHCPv6 is served on the LAN with `uci show dhcp` and look for dhcpv6 settings on the lan interface","fix":"- Move odhcpd to a fixed build as soon as the OpenWrt project publishes one; the sources say no patch was publicly available at publication, so check the OpenWrt security advisories\n- Until then, unknown whether a workaround exists; the sources do not say","status":"open","published_at":"2026-10-23T14:17:53+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:47:15+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:47:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move odhcpd to a fixed build as soon as the OpenWrt project publishes one; the sources say no patch was publicly available at publication, so check the OpenWrt security advisories\n- Until then, unknown whether a workaround exists; the sources do not say","reach":"network","title":"OpenWrt odhcpd: one DHCPv6 packet over-reads stack memory","impact":"low","summary":"odhcpd, the DHCPv6/DHCPv4/router-advertisement server used by OpenWrt, reads a length field in network byte order as a native integer during DHCPv6 self-loop detection. On little-endian hosts a single unauthenticated DHCPv6 packet makes memcmp() read about 2560 bytes past a 128-byte stack buffer.","category":"infrastructure","nicknames":[],"who_cares":["openwrt","routers","self-hosted","dhcpv6"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote memory over-read in the router DHCPv6 daemon, possibly crashing it","analyst_note":"Confirm the affected version range, whether a patch or workaround exists, and whether the overread only leaks memory or can also crash odhcpd; check the NVD entry and OpenWrt advisories.","how_to_check":"- `opkg list-installed | grep odhcpd` to see the installed odhcpd version\n- Check the OpenWrt release with `cat /etc/openwrt_release`; the sources say versions 25.12 and prior are affected\n- Confirm whether DHCPv6 is served on the LAN with `uci show dhcp` and look for dhcpv6 settings on the lan interface","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Devices running OpenWrt 25.12 or earlier where odhcpd handles DHCPv6 on a network an attacker can send packets to, such as a LAN or a directly connected segment. Routers that do not run odhcpd for DHCPv6, or that only serve IPv4 DHCP, are less exposed; the sources do not say exactly which configurations trigger the overread.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":3412,"output_tokens":762,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-55606':13A,16A '128':67B,141C '25.12':86C '2560':63B,136C '720':98C 'advertis':79C 'avail':152C 'beyond':125C 'buffer':70B,128C,143C 'byte':37B,64B,68B,103C,137C,142C 'caus':120C 'cve':11A,14A 'detect':48B,95C 'dhcpv4':75C 'dhcpv6':4A,17B,44B,57B,74C,91C,132C 'dhcpv6.c':97C 'dhcpv6/dhcpv4/router-advertisement':26B 'direct':108C 'duid':105C 'endian':52B,117C 'far':124C 'field':34B 'host':23B,53B,118C 'infrastructur':18B 'integ':42B 'length':33B,106C 'littl':51B,116C 'little-endian':50B,115C 'loop':47B,94C 'make':59B 'memcmp':60B,111C,121C 'memori':10A 'nativ':41B 'network':36B,102C 'network-byte-ord':101C 'odhcpd':2A,24B,71C,89C 'one':3A 'openwrt':1A,19B,30B,83C 'order':38B,104C 'over-read':6A 'overread':138C 'packet':5A,58B,133C 'paramet':113C 'past':65B 'patch':153C 'prior':88C 'public':147C,151C 'read':8A,31B,61B,123C 'router':20B,78C 'router-advertis':77C 'self':22B,46B,93C 'self-host':21B 'self-loop':45B,92C 'server':27B,80C 'singl':55B,130C 'size':112C 'stack':9A,69B,127C 'time':145C 'trigger':134C 'unauthent':56B,131C 'use':28B,81C,99C 'valu':107C 'version':85C","nicknames":[],"mitigations":[],"who_affected":"Devices running OpenWrt 25.12 or earlier where odhcpd handles DHCPv6 on a network an attacker can send packets to, such as a LAN or a directly connected segment. Routers that do not run odhcpd for DHCPv6, or that only serve IPv4 DHCP, are less exposed; the sources do not say exactly which configurations trigger the overread.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55606","severity":null,"published_at":"2026-10-23T14:17:53+00:00","modified_at":"2026-10-23T19:37:11+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-55606","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55606","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}