This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-56113 →
ALPINE-CVE-2026-56113
dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash...
Original description
The description as published by the source.
dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.23
dhcpcd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.2-r0"}]}]
Alpine:v3.24
dhcpcd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.2-r0"}]}]
References
- advisory security.alpinelinux.org