CVE-2026-18103: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-18103 is a classic buffer overflow vulnerability in the dhcp-server (ISC DHCP / dhcpd) affecting the print_hw_addr() function, exploitable via the OMAPI (Open Management Application Programming Interface) port. A remote attacker with network access to the OMAPI port (TCP 7911) — particularly when TSIG key authentication is not configured — can send a specially crafted lease creation request containing an overly long InfiniBand MAC address to trigger the overflow. Successful exploitation causes a persistent denial of service, crashing the dhcpd service and preventing automatic restart. The vulnerability was published on August 5, 2026, discovered by Martin Osvald of Red Hat, and carries a CVSS v3.1 base score of 4.9 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is CWE-120 (Buffer Copy without Checking Size of Input — Classic Buffer Overflow): the print_hw_addr() function in dhcpd does not validate the length of the hardware address field before copying it into a fixed-size buffer. An attacker exploits this by sending a crafted OMAPI lease creation request that includes an InfiniBand MAC address exceeding the expected maximum length, overflowing the buffer and corrupting process memory. The attack vector is network-based, requires high privileges only if TSIG authentication is enforced (otherwise no credentials are needed), and requires no user interaction. The overflow results in a process crash rather than code execution under typical conditions, and the corrupted lease entry persists in /var/lib/dhcpd/dhcpd.leases, preventing the service from restarting automatically (Red Hat Advisory, Github Advisory).

Successful exploitation results in a persistent denial of service: the dhcpd service crashes and cannot restart without manual administrator intervention to remove the malformed lease entry from /var/lib/dhcpd/dhcpd.leases. This disrupts DHCP services for all network clients relying on the affected server, potentially causing widespread network connectivity loss in environments where DHCP is critical infrastructure. There is no confidentiality or integrity impact — the vulnerability is limited to availability (Red Hat Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not fully automatable due to the high privileges required when TSIG is configured. The EPSS score is approximately 0.4% (33rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection (plugin ID 332066) is available for scanning (Red Hat Advisory).

1. Reconnaissance: Identify hosts running dhcpd with the OMAPI port (TCP 7911) exposed to the network using tools such as Nmap (nmap -p 7911 <target>).
2. Assess authentication: Determine whether TSIG key authentication is configured on the OMAPI interface. If not configured, no credentials are required to proceed.
3. Craft malicious OMAPI request: Construct a lease creation request via the OMAPI protocol that includes an InfiniBand hardware address field exceeding the expected maximum length (e.g., a MAC address string significantly longer than the 20-byte InfiniBand address format).
4. Send the request: Transmit the crafted OMAPI message to the target server on port 7911. Tools such as omshell (part of the ISC DHCP package) or a custom OMAPI client can be used to send raw OMAPI messages.
5. Trigger crash: The print_hw_addr() function processes the oversized address without bounds checking, overflowing the buffer and crashing the dhcpd process.
6. Achieve persistent DoS: The malformed lease entry is written to /var/lib/dhcpd/dhcpd.leases, causing dhcpd to fail on every subsequent restart attempt until an administrator manually removes the entry (Red Hat Advisory).

• Network: Unexpected or repeated TCP connections to port 7911 (dhcpd OMAPI port) from untrusted or external IP addresses; OMAPI traffic containing unusually large hardware address fields.
• Logs: System logs (/var/log/messages, journalctl) showing dhcpd crash events (segmentation fault or similar) followed by repeated failed restart attempts; entries referencing print_hw_addr() in core dump output.
• File System: Presence of a malformed InfiniBand lease entry in /var/lib/dhcpd/dhcpd.leases with an abnormally long hardware address field; core dump files generated by the dhcpd process in the working directory.
• Process: Absence of a running dhcpd process on a server expected to be providing DHCP services; repeated systemd or init system attempts to restart dhcpd that immediately fail (Red Hat Advisory).

Red Hat classifies this as Moderate impact and recommends the following mitigations: (1) Configure TSIG key authentication on the OMAPI interface to require authentication for all lease creation requests, preventing unauthenticated access to port 7911. (2) Restrict network access to the OMAPI port (TCP 7911) using firewall rules, limiting connections to trusted management hosts only. (3) Disable OMAPI entirely if it is not required for operational needs. If the dhcpd service has already crashed, manually remove the malformed InfiniBand lease entry from /var/lib/dhcpd/dhcpd.leases before restarting the service — note that restarting will temporarily interrupt DHCP services for clients. No specific patched package version was identified in available data at time of publication (Red Hat Advisory, Github Advisory).

The vulnerability was discovered internally by Martin Osvald of Red Hat and reported via Red Hat Bugzilla (Bug #2508081). Red Hat has classified the flaw as Moderate severity and published a detailed advisory with mitigation guidance. No significant broader community discussion, researcher commentary, or media coverage has been identified beyond standard vulnerability database aggregation (Red Hat Advisory).