ConnMan (<= 2.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/connman--2.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 19:51:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgConnMan: Stack-based buffer overflow in DHCPv6 (CVE-2026-115863)https://feed.craftedsignal.io/briefs/2026-10-connman-dhcpv6-overflow/Fri, 23 Oct 2026 19:51:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-connman-dhcpv6-overflow/ConnMan versions up to and including 2.0 contain a stack-based buffer overflow in the DHCPv6 client, allowing an on-link attacker to cause a root-privileged service crash.ConnMan versions up to and including 2.0 are vulnerable to a stack-based buffer overflow in the DHCPv6 implementation. The vulnerability resides in the get_domains function within gdhcp/client.c. Improper handling of the DOMAIN_LIST (option 24) in DHCPv6 Reply messages allows for memory corruption during DNS label parsing. The flaw is triggered when the client processes a crafted Reply message containing a DOMAIN_LIST option exceeding 1025 bytes, resulting in out-of-bounds reads and writes.

Impact

Successful exploitation allows an unauthenticated, on-link attacker to crash the connmand service. Because connmand typically operates with root privileges, this results in a denial-of-service condition for the affected system's network management functionality.

Recommendation

Identify systems running connmand versions 2.0 or earlier. Monitor vendor security channels for the release of a patched version of ConnMan and schedule upgrades accordingly. As this is an on-link network attack, segment vulnerable systems where possible until patches are applied.

]]>highadvisory