CVE-2026-18103: DHCP Server Buffer Overflow DoS Vulnerability

CVE-2026-18103 Overview

CVE-2026-18103 is a buffer overflow vulnerability in the ISC dhcp-server package. The flaw resides in the print_hw_addr() function, which mishandles overly long InfiniBand MAC addresses supplied through the Open Management Application Programming Interface (OMAPI). A remote attacker with network access to the OMAPI port can send a specially crafted lease creation request to trigger the overflow. Successful exploitation crashes the dhcpd service and prevents it from restarting without manual operator intervention, producing a persistent denial of service. Environments that expose OMAPI without Transaction Signature (TSIG) key authentication are the most exposed. The vulnerability is classified under [CWE-120] (Classic Buffer Overflow).

Critical Impact
Remote attackers can crash the dhcpd service and block automatic recovery, disrupting DHCP address assignment across the affected network segment.

Affected Products

ISC dhcp-server (dhcpd) implementations shipping the vulnerable print_hw_addr() routine
Red Hat Enterprise Linux distributions packaging the affected dhcp-server
Downstream Linux distributions consuming the upstream ISC DHCP source

Discovery Timeline

2026-08-05 - CVE-2026-18103 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18103

Vulnerability Analysis

The defect is a classic stack or buffer overflow inside print_hw_addr(), a helper that formats hardware addresses for logging and lease management. When the function processes an InfiniBand MAC address, it does not properly bound the input length against the destination buffer. An attacker who can reach the OMAPI listener can submit a lease creation request carrying an oversized InfiniBand hardware address. The overflow corrupts adjacent memory and terminates dhcpd. Because the process does not self-recover, DHCP service remains offline until an administrator restarts the daemon, which extends the denial-of-service window.

Root Cause

The root cause is missing length validation on the hardware address field before it is written into a fixed-size buffer inside print_hw_addr(). InfiniBand hardware addresses are 20 bytes, longer than Ethernet MAC addresses, and the affected code path does not enforce this maximum. Any oversized value passed via OMAPI reaches the formatting routine and overruns the buffer.

Attack Vector

Exploitation requires network reachability to the OMAPI port and sufficient privilege to submit lease modification commands. When TSIG key authentication is not enforced on OMAPI, that privilege effectively drops to any host with network access. The attacker constructs an OMAPI message that creates or updates a lease and populates the hardware address field with an oversized InfiniBand identifier. Delivering the malformed request causes dhcpd to crash immediately on parsing. Refer to the Red Hat CVE-2026-18103 Advisory and Red Hat Bug Report #2508081 for vendor technical details.

// No verified proof-of-concept code is published for this CVE.
// See the Red Hat advisory referenced above for vendor analysis.

Detection Methods for CVE-2026-18103

Indicators of Compromise

Unexpected termination of the dhcpd process without operator action
OMAPI connections from unusual source addresses to the DHCP server management port
Lease creation requests containing hardware address fields longer than 20 bytes
Systemd or init logs showing repeated dhcpd service failures without automatic recovery

Detection Strategies

Monitor dhcpd process lifecycle events and alert on abrupt exits or segmentation faults
Inspect OMAPI traffic for malformed lease objects, particularly oversized hardware-address fields
Correlate DHCP service outages with inbound connections to the OMAPI port for root cause analysis

Monitoring Recommendations

Ingest dhcpd and syslog data into a centralized logging platform and alert on service crashes
Enable audit logging on the OMAPI listener and review authentication failures against TSIG keys
Track network flows to the DHCP management port and baseline expected administrative sources

How to Mitigate CVE-2026-18103

Immediate Actions Required

Restrict network access to the OMAPI port using host firewalls and network ACLs so only trusted management hosts can reach it
Enforce TSIG key authentication on all OMAPI communications and reject unauthenticated requests
Apply vendor updates for dhcp-server as soon as fixed packages are published for your distribution
Establish a process to detect and restart dhcpd after unexpected termination to shorten outage windows

Patch Information

Consult the Red Hat CVE-2026-18103 Advisory for fixed package versions and errata specific to Red Hat Enterprise Linux. Downstream distributions should be tracked through their respective security update channels. Apply the patched dhcp-server package and restart dhcpd to activate the corrected print_hw_addr() bounds checking.

Workarounds

Disable OMAPI entirely if it is not required for lease management operations
Bind the OMAPI listener to a management-only interface that is not exposed to client networks
Require TSIG key authentication and rotate keys regularly to limit exposure from key compromise
Deploy watchdog tooling that restarts dhcpd automatically to mitigate the persistent DoS condition

bash

# Example: restrict OMAPI to loopback and require a TSIG key in dhcpd.conf
omapi-port 7911;
key omapi_key {
    algorithm hmac-sha256;
    secret "REPLACE_WITH_BASE64_SECRET";
};
omapi-key omapi_key;

# Example: block external access to the OMAPI port at the host firewall
iptables -A INPUT -p tcp --dport 7911 ! -s 127.0.0.1 -j DROP