This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-14258 →

DEBIAN-CVE-2026-14258

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-...

Original description

The description as published by the source.

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:13 dhcpcd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-11+deb13u4"}]}]

Debian:14 dhcpcd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2.4-3"}]}]

References

advisory security-tracker.debian.org