Homepage

Stack-based Buffer Overflow Affecting connman package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.3% (23rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-CONNMAN-21692372
  • published24 Oct 2026
  • disclosed23 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 23 Oct 2026

NewCVE-2026-115863  (opens in a new tab)
CWE-121  (opens in a new tab)

How to fix?

There is no fixed version for Debian:unstable connman.

NVD Description

Note: Versions mentioned in the description apply only to the upstream connman package and not the connman package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.