This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-48715 →
ALPINE-CVE-2026-48715
radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in...
Original description
The description as published by the source.
radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, print_ff() copies up to 2032 bytes from attacker-controlled packet data into a 16-byte struct in6_addr on the stack, overflowing by up to 2016 bytes. Note that the main radvd daemon is not affected by the vulnerability. Version 2.21 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.24
radvd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21-r0"}]}]
References
- advisory security.alpinelinux.org