---
id: "CVE-2026-55606"
kind: "vulnerability"
aliases: ["CVE-2026-55606"]
title: "OpenWrt odhcpd: one DHCPv6 packet over-reads stack memory"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dhcpv6", "infrastructure", "openwrt", "routers", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-23T14:17:53+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T03:47:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55606", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# OpenWrt odhcpd: one DHCPv6 packet over-reads stack memory

odhcpd, the DHCPv6/DHCPv4/router-advertisement server used by OpenWrt, reads a length field in network byte order as a native integer during DHCPv6 self-loop detection. On little-endian hosts a single unauthenticated DHCPv6 packet makes memcmp() read about 2560 bytes past a 128-byte stack buffer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `opkg list-installed | grep odhcpd` to see the installed odhcpd version
- Check the OpenWrt release with `cat /etc/openwrt_release`; the sources say versions 25.12 and prior are affected
- Confirm whether DHCPv6 is served on the LAN with `uci show dhcp` and look for dhcpv6 settings on the lan interface

## Fix

- Move odhcpd to a fixed build as soon as the OpenWrt project publishes one; the sources say no patch was publicly available at publication, so check the OpenWrt security advisories
- Until then, unknown whether a workaround exists; the sources do not say

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55606

## From the sources

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_