
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-18103 is a classic buffer overflow vulnerability in the dhcp-server (ISC DHCP / dhcpd) affecting the print_hw_addr() function, exploitable via the OMAPI (Open Management Application Programming Interface) port. A remote attacker with network access to the OMAPI port (TCP 7911) — particularly when TSIG key authentication is not configured — can send a specially crafted lease creation request containing an overly long InfiniBand MAC address to trigger the overflow. Successful exploitation causes a persistent denial of service, crashing the dhcpd service and preventing automatic restart. The vulnerability was published on August 5, 2026, discovered by Martin Osvald of Red Hat, and carries a CVSS v3.1 base score of 4.9 (Medium) (Red Hat Advisory, Github Advisory).
The root cause is CWE-120 (Buffer Copy without Checking Size of Input — Classic Buffer Overflow): the print_hw_addr() function in dhcpd does not validate the length of the hardware address field before copying it into a fixed-size buffer. An attacker exploits this by sending a crafted OMAPI lease creation request that includes an InfiniBand MAC address exceeding the expected maximum length, overflowing the buffer and corrupting process memory. The attack vector is network-based, requires high privileges only if TSIG authentication is enforced (otherwise no credentials are needed), and requires no user interaction. The overflow results in a process crash rather than code execution under typical conditions, and the corrupted lease entry persists in /var/lib/dhcpd/dhcpd.leases, preventing the service from restarting automatically (Red Hat Advisory, Github Advisory).
Successful exploitation results in a persistent denial of service: the dhcpd service crashes and cannot restart without manual administrator intervention to remove the malformed lease entry from /var/lib/dhcpd/dhcpd.leases. This disrupts DHCP services for all network clients relying on the affected server, potentially causing widespread network connectivity loss in environments where DHCP is critical infrastructure. There is no confidentiality or integrity impact — the vulnerability is limited to availability (Red Hat Advisory).
As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not fully automatable due to the high privileges required when TSIG is configured. The EPSS score is approximately 0.4% (33rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection (plugin ID 332066) is available for scanning (Red Hat Advisory).
dhcpd with the OMAPI port (TCP 7911) exposed to the network using tools such as Nmap (nmap -p 7911 <target>).omshell (part of the ISC DHCP package) or a custom OMAPI client can be used to send raw OMAPI messages.print_hw_addr() function processes the oversized address without bounds checking, overflowing the buffer and crashing the dhcpd process./var/lib/dhcpd/dhcpd.leases, causing dhcpd to fail on every subsequent restart attempt until an administrator manually removes the entry (Red Hat Advisory).dhcpd OMAPI port) from untrusted or external IP addresses; OMAPI traffic containing unusually large hardware address fields./var/log/messages, journalctl) showing dhcpd crash events (segmentation fault or similar) followed by repeated failed restart attempts; entries referencing print_hw_addr() in core dump output./var/lib/dhcpd/dhcpd.leases with an abnormally long hardware address field; core dump files generated by the dhcpd process in the working directory.dhcpd process on a server expected to be providing DHCP services; repeated systemd or init system attempts to restart dhcpd that immediately fail (Red Hat Advisory).Red Hat classifies this as Moderate impact and recommends the following mitigations: (1) Configure TSIG key authentication on the OMAPI interface to require authentication for all lease creation requests, preventing unauthenticated access to port 7911. (2) Restrict network access to the OMAPI port (TCP 7911) using firewall rules, limiting connections to trusted management hosts only. (3) Disable OMAPI entirely if it is not required for operational needs. If the dhcpd service has already crashed, manually remove the malformed InfiniBand lease entry from /var/lib/dhcpd/dhcpd.leases before restarting the service — note that restarting will temporarily interrupt DHCP services for clients. No specific patched package version was identified in available data at time of publication (Red Hat Advisory, Github Advisory).
The vulnerability was discovered internally by Martin Osvald of Red Hat and reported via Red Hat Bugzilla (Bug #2508081). Red Hat has classified the flaw as Moderate severity and published a detailed advisory with mitigation guidance. No significant broader community discussion, researcher commentary, or media coverage has been identified beyond standard vulnerability database aggregation (Red Hat Advisory).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."