https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 17:21:00 +0000 https://db.gcve.eu/vuln/cve-2026-115863 <p><strong>Affected:</strong> ConnMan</p> <p>ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded &#34;c += jump + 1&#34; loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of &gt;= 1025 non-zero bytes makes the label walk leave the buffer and read/write &#39;.&#39; past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.</p> <p><strong>Affected:</strong> ConnMan</p> <p>ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded &#34;c += jump + 1&#34; loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of &gt;= 1025 non-zero bytes makes the label walk leave the buffer and read/write &#39;.&#39; past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.</p> https://db.gcve.eu/vuln/cve-2026-115863