{"id":"CVE-2026-41285","details":"In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an \"nd_opt_len * 8 - 2\" expression with no preceding check for whether nd_opt_len is zero.","modified":"2026-10-21T09:59:56.982983859Z","published":"2026-04-20T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41285.json","unresolved_ranges":[{"extracted_events":[{"range":[{"last_affected":"7.8"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]},{"extracted_events":[{"strategy":"CPEApplicability","range":[{"last_affected":"7.8"}],"source":"CPE_FIELD"}]},{"extracted_events":[{"range":[{"last_affected":"7.8"}],"source":"DESCRIPTION"}]}],"cna_assigner":"mitre","cwe_ids":["CWE-1284"]},"references":[{"type":"WEB","url":"https://www.openbsd.org/errata78.html"},{"type":"WEB","url":"https://www.rfc-editor.org/rfc/rfc4861#section-4.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41285.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41285"},{"type":"FIX","url":"https://github.com/openbsd/src/commit/086c5738bcd3c203bcc08d024fcf983cb409115f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openbsd/src","events":[{"introduced":"0"},{"fixed":"086c5738bcd3c203bcc08d024fcf983cb409115f"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"086c5738bcd3c203bcc08d024fcf983cb409115f"}]}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41285.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openbsd/src/commit/086c5738bcd3c203bcc08d024fcf983cb409115f","target":{"file":"sbin/slaacd/engine.c","function":"debug_log_ra"},"deprecated":false,"digest":{"function_hash":"55084904214179239878277329076062198518","length":4775},"id":"CVE-2026-41285-0449ba25"},{"deprecated":false,"digest":{"line_hashes":["48713586193299179511207501892454092382","6803437703085198769861233072729433964","94798943488508846599969759443795066058","68790898117178157355636818943846466270"],"threshold":0.9},"id":"CVE-2026-41285-28999357","signature_type":"Line","signature_version":"v1","source":"https://github.com/openbsd/src/commit/086c5738bcd3c203bcc08d024fcf983cb409115f","target":{"file":"usr.sbin/rad/engine.c"}},{"source":"https://github.com/openbsd/src/commit/086c5738bcd3c203bcc08d024fcf983cb409115f","target":{"file":"sbin/slaacd/engine.c","function":"parse_ra"},"deprecated":false,"digest":{"function_hash":"103454554488181703750540438355197157328","length":4881},"id":"CVE-2026-41285-444211c3","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["48713586193299179511207501892454092382","8225582915593438507300275592679153491","270807346468397460396099472831071725856","57294633412882391619045507536442616748","331778918316045201086760500425494388201","270807346468397460396099472831071725856","57294633412882391619045507536442616748"],"threshold":0.9},"id":"CVE-2026-41285-6b7f0cb8","signature_type":"Line","signature_version":"v1","source":"https://github.com/openbsd/src/commit/086c5738bcd3c203bcc08d024fcf983cb409115f","target":{"file":"sbin/slaacd/engine.c"},"deprecated":false},{"id":"CVE-2026-41285-9752a8e0","signature_type":"Function","signature_version":"v1","source":"https://github.com/openbsd/src/commit/086c5738bcd3c203bcc08d024fcf983cb409115f","target":{"file":"usr.sbin/rad/engine.c","function":"parse_rs"},"deprecated":false,"digest":{"function_hash":"259629776323187315089113078194840962558","length":2065}}],"vanir_signatures_modified":"2026-10-21T09:59:56Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}