This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-56116 →
ALPINE-CVE-2026-56116
dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that...
Original description
The description as published by the source.
dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.23
dhcpcd
[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.7"},{"fixed":"10.5.2-r0"}]}]
Alpine:v3.24
dhcpcd
[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.7"},{"fixed":"10.5.2-r0"}]}]
References
- advisory security.alpinelinux.org