{"id":"AZL-113930","summary":"CVE-2026-124740 affecting package busybox 1.36.1-28","details":"A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests.","modified":"2026-11-15T14:16:44.854443168Z","published":"2026-11-11T12:19:47Z","upstream":["CVE-2026-124740"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124740"}],"affected":[{"package":{"name":"busybox","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/busybox"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.36.1-28"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113930.json"}}],"schema_version":"1.9.2"}