---
id: CVE-2026-18103
title: >-
  Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow
  via omapi
summary: >-
  A flaw was found in dhcp-server. A remote attacker with network access to the
  OMAPI (Open Management Application Programming Interface) port, especially if
  not secured with TSIG (Transaction Signature) key authentication, could send a
  sp…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-120
vendor: Red Hat
product: dhcp
affected:
  - dhcp (all versions)
  - dhcp (all versions)
  - dhcp (all versions)
  - dhcp (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-05T13:58:45.550060Z'
published: '2026-08-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:08:49.111Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-18103'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-18103'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2508081'
    label: RHBZ#2508081
tags:
  - cve.org
epss: 0.00709
epssPercentile: 0.53738
ingestedAt: '2026-11-06T19:01:36.641Z'
---

## Overview

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.

## Affected

- `dhcp (all versions)`
- `dhcp (all versions)`
- `dhcp (all versions)`
- `dhcp (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, secure OMAPI access by configuring TSIG key authentication to prevent unauthorized connections to the OMAPI port (7911). If the `dhcpd` service has already crashed due to this flaw, manually remove the problematic InfiniBand lease entry from `/var/lib/dhcpd/dhcpd.leases` and then restart the `dhcpd` service. Restarting the `dhcpd` service may temporarily interrupt DHCP services for clients.