Loop with Unreachable Exit Condition ('Infinite Loop') Affecting dhcpcd-debugsource package, versions <0:10.0.6-11.el10_2


Severity

Recommended
0.0
medium
0
10

Based on CentOS security rating.

Threat Intelligence

EPSS
0.4% (34th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS10-DHCPCDDEBUGSOURCE-18742536
  • published13 Aug 2026
  • disclosed1 Jan 2026

Introduced: 1 Jan 2026

CVE-2026-14258  (opens in a new tab)
CWE-835  (opens in a new tab)

How to fix?

Upgrade Centos:10 dhcpcd-debugsource to version 0:10.0.6-11.el10_2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream dhcpcd-debugsource package and not the dhcpcd-debugsource package as distributed by Centos. See How to fix? for Centos:10 relevant fixed versions and status.

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

CVSS Base Scores

version 3.1