{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/connman--2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:connman:connman:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-115863"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ConnMan (\u003c= 2.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ConnMan"],"content_html":"\u003cp\u003eConnMan versions up to and including 2.0 are vulnerable to a stack-based buffer overflow in the DHCPv6 implementation. The vulnerability resides in the \u003ccode\u003eget_domains\u003c/code\u003e function within \u003ccode\u003egdhcp/client.c\u003c/code\u003e. Improper handling of the DOMAIN_LIST (option 24) in DHCPv6 Reply messages allows for memory corruption during DNS label parsing. The flaw is triggered when the client processes a crafted Reply message containing a DOMAIN_LIST option exceeding 1025 bytes, resulting in out-of-bounds reads and writes.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated, on-link attacker to crash the \u003ccode\u003econnmand\u003c/code\u003e service. Because \u003ccode\u003econnmand\u003c/code\u003e typically operates with root privileges, this results in a denial-of-service condition for the affected system's network management functionality.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eIdentify systems running \u003ccode\u003econnmand\u003c/code\u003e versions 2.0 or earlier. Monitor vendor security channels for the release of a patched version of ConnMan and schedule upgrades accordingly. As this is an on-link network attack, segment vulnerable systems where possible until patches are applied.\u003c/p\u003e\n","date_modified":"2026-10-23T19:51:12Z","date_published":"2026-10-23T19:51:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-connman-dhcpv6-overflow/","summary":"ConnMan versions up to and including 2.0 contain a stack-based buffer overflow in the DHCPv6 client, allowing an on-link attacker to cause a root-privileged service crash.","title":"ConnMan: Stack-based buffer overflow in DHCPv6 (CVE-2026-115863)","url":"https://feed.craftedsignal.io/briefs/2026-10-connman-dhcpv6-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - ConnMan (\u003c= 2.0)","version":"https://jsonfeed.org/version/1.1"}