{"id":"UBUNTU-CVE-2026-115863","details":"ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded \"c += jump + 1\" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of \u003e= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.","modified":"2026-10-27T04:16:44.182015596Z","published":"2026-10-26T00:00:00Z","upstream":["CVE-2026-115863"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-115863"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-115863"},{"type":"REPORT","url":"https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=bb06c47101ca243fa5c04fb4b03fe2a12420d280"},{"type":"REPORT","url":"https://git.kernel.org/pub/scm/network/connman/connman.git/tree/gdhcp/client.c"},{"type":"REPORT","url":"https://lore.kernel.org/connman/179274561161.81299.4579745057858200074@pm.me/"}],"affected":[{"package":{"name":"connman","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/connman?arch=source&distro=esm-apps%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21-1.2","1.21-1.2build1","1.21-1.2build2","1.21-1.2+deb8u1build0.16.04.1","1.21-1.2+deb8u1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"connman","binary_version":"1.21-1.2+deb8u1ubuntu0.1~esm1"},{"binary_version":"1.21-1.2+deb8u1ubuntu0.1~esm1","binary_name":"connman-vpn"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115863.json"}},{"package":{"name":"connman","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/connman?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35-1","1.35-2","1.35-6","1.35-6ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"connman","binary_version":"1.35-6ubuntu0.1~esm1"},{"binary_name":"connman-vpn","binary_version":"1.35-6ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115863.json"}},{"package":{"name":"connman","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/connman?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.36-2build1","1.36-2ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.36-2ubuntu0.1","binary_name":"connman"},{"binary_name":"connman-vpn","binary_version":"1.36-2ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115863.json"}},{"package":{"name":"connman","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/connman?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.36-2.2build1","1.36-2.3","1.36-2.3build1","1.36-2.3ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.36-2.3ubuntu0.1","binary_name":"connman"},{"binary_name":"connman-vpn","binary_version":"1.36-2.3ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115863.json"}},{"package":{"name":"connman","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/connman?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.41-3","1.42-1","1.42-3","1.42-5","1.42-5build2","1.42-5build3"],"ecosystem_specific":{"binaries":[{"binary_name":"connman","binary_version":"1.42-5build3"},{"binary_version":"1.42-5build3","binary_name":"connman-tests"},{"binary_name":"connman-vpn","binary_version":"1.42-5build3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115863.json"}},{"package":{"name":"connman","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/connman?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.45-3","2.0-2"],"ecosystem_specific":{"binaries":[{"binary_name":"connman","binary_version":"2.0-2"},{"binary_name":"connman-tests","binary_version":"2.0-2"},{"binary_name":"connman-vpn","binary_version":"2.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115863.json"}},{"package":{"name":"connman","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/connman?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.44-3","1.45-2","1.45-3"],"ecosystem_specific":{"binaries":[{"binary_version":"1.45-3","binary_name":"connman"},{"binary_name":"connman-tests","binary_version":"1.45-3"},{"binary_name":"connman-vpn","binary_version":"1.45-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115863.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"type":"Ubuntu","score":"medium"}]}