{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "openwrt odhcpd: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/openwrt--odhcpd/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/openwrt--odhcpd/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-53918/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-53918/",
   "title": "CVE-2026-53918 · openwrt odhcpd · disclosed",
   "content_text": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first-\u003ekey`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.",
   "date_published": "2026-10-23T13:21:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-53920/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-53920/",
   "title": "CVE-2026-53920 · openwrt odhcpd · disclosed",
   "content_text": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia-\u003eiaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.",
   "date_published": "2026-10-23T13:20:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-53921/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-53921/",
   "title": "CVE-2026-53921 · openwrt odhcpd · disclosed",
   "content_text": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.",
   "date_published": "2026-10-23T13:20:30Z"
  }
 ]
}