PatchTheCVEdhcpcd vulnerabilities and fixes
Recent CVEs affecting dhcpcd, with upgrade or downgrade steps. 4 tracked.
dhcpcd has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-06-23. Highest priority: CVE-2026-56116 (score 28/100).
- CVE-2026-56116 MEDIUM 6.5 UPGRADE dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advert
- CVE-2026-56113 MEDIUM 5.3 UPGRADE dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unaut
- CVE-2026-56114 MEDIUM 5.3 UPGRADE dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in
- CVE-2026-56117 MEDIUM 4.7 UPGRADE dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control so
FAQ
How do I fix dhcpcd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dhcpcd being exploited right now?
None of the tracked dhcpcd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dhcpcd CVE should I patch first?
CVE-2026-56116 currently ranks highest (28/100): dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advert.