CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.

• CWE-121

• https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=bb06c47101ca243fa5c04fb4b03fe2a12420d280
• https://git.kernel.org/pub/scm/network/connman/connman.git/tree/gdhcp/client.c
• https://lore.kernel.org/connman/179274561161.81299.4579745057858200074@pm.me/

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11582A flaw has been found in CodeAstro Student Attendance Manage…7.3
• CVE-2026-11583A vulnerability has been found in CodeAstro Student Attendan…6.3
• CVE-2026-11584A vulnerability was found in CodeAstro Student Attendance Ma…6.3
• CVE-2026-115845An incomplete list of disallowed inputs in the Python code v…6.4
• CVE-2026-11585A vulnerability was determined in CodeAstro Student Attendan…6.3
• CVE-2026-11586By default, curl automatically responds to WebSocket PING fr…7.5
• CVE-2026-115877Twisted is an event-based framework for internet application…5.4
• CVE-2026-11588The EONSR AEO Agent WordPress plugin through 3.7.9 does not …6.1
• CVE-2026-115883LangGraph checkpoint savers provide Postgres- and SQLite-bac…6
• CVE-2026-115885The LangGraph CLI is the official command-line interface for…4.1
• CVE-2026-115886MLflow is an open source AI engineering platform for agents,…6.5
• CVE-2026-115887GraphQL Scalars is a library of custom GraphQL scalars for c…7.5