CVE-2026-18103 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for dhcp-server installations, especially those with exposed OMAPI ports or lacking TSIG key authentication, should review and apply vendor patches or updates to dhcp-server. They should also restrict access to the OMAPI port and enable TSIG key authentication for OMAPI. Additionally, they should monitor for potential exploitation attempts and review system logs for signs of compromise. Affected operators, platforms, and vulnerability management teams should prioritize patching and mitigation efforts. Security teams should verify that compensating controls are in place for exposed systems and monitor for potential security incidents. Asset inventory and change management processes should be reviewed to ensure that affected systems are identified and prioritized for remediation. Rollback and change window procedures should be evaluated to minimize potential downtime and ensure smooth patch deployment. Source tracking and monitoring should be implemented to detect potential exploitation attempts. Overall, a coordinated effort is required to address this vulnerability and prevent potential security incidents. The debrief provides an executive overview of the vulnerability, its likely operational impact, and the necessary steps for mitigation and remediation. It is essential to review the context and source-confidence limits of this information to ensure accurate prioritization and response. The CVE record was published on 2026-08-05T00:16:59.110Z and has not been modified since then. The NVD detail page and Red Hat security advisory provide additional information on the vulnerability and recommended mitigations. By understanding the vulnerability class and its potential impact, defenders can take proactive steps to prevent exploitation and minimize potential damage. The debrief aims to provide a concise and informative summary of the vulnerability and its implications, enabling defenders to respond effectively and prioritize their remediation efforts. The information provided is based on official CVE and NVD sources, as well as Red Hat security advisories, to ensure accuracy and reliability. By following the debr

Technical summary

A buffer overflow vulnerability exists in dhcp-server. A remote attacker with network access to the OMAPI port, especially if not secured with TSIG key authentication, could send a specially crafted lease creation request containing an overly long InfiniBand MAC address. This triggers a buffer overflow in the `print_hw_addr()` function, leading to a persistent denial of service (DoS) and causing the `dhcpd` service to crash.

Defensive priority

Medium priority due to potential for denial of service

Recommended defensive actions

• Apply vendor patches or updates to dhcp-server
• Restrict access to the OMAPI port
• Enable TSIG key authentication for OMAPI
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from official CVE and NVD sources indicates a buffer overflow vulnerability in dhcp-server. A remote attacker could send a specially crafted lease creation request with an overly long InfiniBand MAC address, triggering a buffer overflow in the `print_hw_addr()` function. This leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash.

Official resources