odhcpd vulnerabilities

3 known vulnerabilities in odhcpd from OpenWrt. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  odhcpd: Stack-based Buffer Overflow

  CVE-2026-53921Oct 23, 2026OpenWrtEPSS 1.12%

  odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to ne

• 8.7 High severity

  odhcpd: Out-of-bounds Read

  CVE-2026-53920Oct 23, 2026OpenWrt

  odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header t

• 8.8 High severity

  odhcpd: Use After Free

  CVE-2026-53918Oct 23, 2026OpenWrt

  odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A D