CVE catalog
CVE-2018-5733
isc-dhcp: CVE-2018-5733
- Severity
- Medium · CVSS 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 20.24% · Oct 25, 2026
A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | isc-dhcp | trixie | 4.4.3-P1-8 | fixed |
| Debian | isc-dhcp | bookworm | 4.4.3-P1-2 | fixed |
| Alpine | dhcp | 3.10 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.11 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.12 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.13 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.14 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.15 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.16 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.17 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.18 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.19 | 4.4.1-r0 | fixed |
| Alpine | dhcp | 3.20 | 4.4.1-r0 | fixed |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu8 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu9 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu10 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu11 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.1 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.2 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.3 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.4 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.5 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.6 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.7 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.8 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.9 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.10 | vulnerable |
| Ubuntu | isc-dhcp | 14.04 | 4.2.4-7ubuntu12.12 | fixed |
| Ubuntu | isc-dhcp | 16.04 | 4.3.1-5ubuntu3 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.1-5ubuntu4 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.1-5ubuntu5 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu1 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu2 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu4 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu5 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu7 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu8 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu9 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu10 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu11 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu12 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu12.1 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu12.3 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu12.4 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu12.6 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu12.7 | vulnerable |
| Ubuntu | isc-dhcp | 16.04 | 4.3.3-5ubuntu12.9 | fixed |
| Ubuntu | isc-dhcp | 18.04 | 4.3.5-3ubuntu2 | vulnerable |
| Ubuntu | isc-dhcp | 18.04 | 4.3.5-3ubuntu3 | vulnerable |
| Ubuntu | isc-dhcp | 18.04 | 4.3.5-3ubuntu4 | vulnerable |
| Ubuntu | isc-dhcp | 18.04 | 4.3.5-3ubuntu5 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | isc-dhcp | source | trixie | 4.3.5-3.1 | not yet assigned | Not reported | [891785] |
| Debian | isc-dhcp | source | bookworm | 4.3.5-3.1 | not yet assigned | Not reported | [891785] |
| Alpine | dhcp | apk | 3.10 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.11 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.12 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.13 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.14 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.15 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.16 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.17 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.18 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.19 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Alpine | dhcp | apk | 3.20 | 4.4.1-r0 | Not reported | ALPINE-CVE-2018-5733 | Not reported |
| Ubuntu | isc-dhcp | deb | 14.04 | 4.2.4-7ubuntu12.12 | Not reported | UBUNTU-CVE-2018-5733 | Not reported |
| Ubuntu | isc-dhcp | deb | 16.04 | 4.3.3-5ubuntu12.9 | Not reported | UBUNTU-CVE-2018-5733 | Not reported |
| Ubuntu | isc-dhcp | deb | 18.04 | 4.3.5-3ubuntu5 | Not reported | UBUNTU-CVE-2018-5733 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [isc-dhcp-client]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-2· amd64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
4.4.3-P1-2· arm64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- [isc-dhcp-client-ddns]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-2· amd64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
4.4.3-P1-2· arm64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- [isc-dhcp-common]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-2· amd64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
4.4.3-P1-2· arm64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- [isc-dhcp-dev]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-2· amd64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
4.4.3-P1-2· arm64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- [isc-dhcp-relay]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-2· amd64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
4.4.3-P1-2· arm64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- [isc-dhcp-server]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-2· amd64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
4.4.3-P1-2· arm64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- [isc-dhcp-server-ldap]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-2· amd64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
4.4.3-P1-2· arm64 · bookwormFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
[Debian 13 (Trixie)]
- [isc-dhcp-client]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-8· amd64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
4.4.3-P1-8· arm64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
- [isc-dhcp-client-ddns]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-8· amd64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
4.4.3-P1-8· arm64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
- [isc-dhcp-common]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-8· amd64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
4.4.3-P1-8· arm64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
- [isc-dhcp-dev]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-8· amd64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
4.4.3-P1-8· arm64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
- [isc-dhcp-keama]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-8· amd64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
4.4.3-P1-8· arm64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
- [isc-dhcp-relay]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-8· amd64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
4.4.3-P1-8· arm64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
- [isc-dhcp-server]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-8· amd64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
4.4.3-P1-8· arm64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
- [isc-dhcp-server-ldap]Fixed
Source package: [isc-dhcp]
Details (2)
4.4.3-P1-8· amd64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
4.4.3-P1-8· arm64 · trixieFixed · Fixed:
4.3.5-3.1dsa · isc-dhcp · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2018_0483.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2018-5733]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2018-5733]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2018-5733]
- [https://security-tracker.debian.org/tracker/CVE-2018-5733]
- [https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-5733.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2018/wid-sec-w-2023-0525.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]