CVE catalog

CVE-2019-6470

isc-dhcp: CVE-2019-6470

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: May 3, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 8.81% · Oct 25, 2026

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	isc-dhcp	trixie	`4.4.3-P1-8`	fixed
Debian	isc-dhcp	bookworm	`4.4.3-P1-2`	fixed
Alpine	dhcp	3.11	`4.4.1-r0`	fixed
Alpine	dhcp	3.12	`4.4.1-r0`	fixed
Alpine	dhcp	3.13	`4.4.1-r0`	fixed
Alpine	dhcp	3.14	`4.4.1-r0`	fixed
Alpine	dhcp	3.15	`4.4.1-r0`	fixed
Alpine	dhcp	3.16	`4.4.1-r0`	fixed
Alpine	dhcp	3.17	`4.4.1-r0`	fixed
Alpine	dhcp	3.18	`4.4.1-r0`	fixed
Alpine	dhcp	3.19	`4.4.1-r0`	fixed
Alpine	dhcp	3.20	`4.4.1-r0`	fixed
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu2`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu3`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu4`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu5`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu6`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu7`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu7.1`	fixed
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu2`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu3`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu4`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu5`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu6`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu7`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu7.1`	fixed
Suse	dhcp	linux enterprise software development kit 12 sp5	`4.3.3-10.19.1`	fixed
Suse	dhcp	linux enterprise server 12 sp5	`4.3.3-10.19.1`	fixed
Suse	dhcp	linux enterprise server for sap applications 12 sp5	`4.3.3-10.19.1`	fixed
Suse	dhcp	linux enterprise module for basesystem 15	`4.3.5-6.3.1`	fixed
Suse	dhcp	linux enterprise module for basesystem 15 sp1	`4.3.5-6.3.1`	fixed
Suse	dhcp	linux enterprise module for server applications 15	`4.3.5-6.3.1`	fixed
Suse	dhcp	linux enterprise module for server applications 15 sp1	`4.3.5-6.3.1`	fixed
Opensuse	dhcp	leap 15.0	`4.3.5-lp150.5.3.1`	fixed
Opensuse	dhcp	leap 15.1	`4.3.5-lp151.6.3.1`	fixed
Suse	dhcp	linux enterprise desktop 12 sp4	`4.3.3-10.19.1`	fixed
Suse	dhcp	linux enterprise software development kit 12 sp4	`4.3.3-10.19.1`	fixed
Suse	dhcp	linux enterprise server 12 sp4	`4.3.3-10.19.1`	fixed
Suse	dhcp	linux enterprise server for sap applications 12 sp4	`4.3.3-10.19.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	isc-dhcp	source	trixie	`4.4.1-2`	not yet assigned	Not reported	[896122]
Debian	isc-dhcp	source	bookworm	`4.4.1-2`	not yet assigned	Not reported	[896122]
Alpine	dhcp	apk	3.11	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Alpine	dhcp	apk	3.12	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Alpine	dhcp	apk	3.13	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Alpine	dhcp	apk	3.14	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Alpine	dhcp	apk	3.15	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Alpine	dhcp	apk	3.16	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Alpine	dhcp	apk	3.17	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Alpine	dhcp	apk	3.18	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Alpine	dhcp	apk	3.19	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Alpine	dhcp	apk	3.20	`4.4.1-r0`	Not reported	ALPINE-CVE-2019-6470	Not reported
Ubuntu	isc-dhcp	deb	18.04	`4.3.5-3ubuntu7.1`	Not reported	UBUNTU-CVE-2019-6470	Not reported
Ubuntu	isc-dhcp	deb	18.04	`4.3.5-3ubuntu7.1`	Not reported	USN-3973-1	Not reported
Suse	dhcp	rpm	linux enterprise software development kit 12 sp5	`4.3.3-10.19.1`	Not reported	SUSE-SU-2019:2727-2	Not reported
Suse	dhcp	rpm	linux enterprise server 12 sp5	`4.3.3-10.19.1`	Not reported	SUSE-SU-2019:2727-2	Not reported
Suse	dhcp	rpm	linux enterprise server for sap applications 12 sp5	`4.3.3-10.19.1`	Not reported	SUSE-SU-2019:2727-2	Not reported
Suse	dhcp	rpm	linux enterprise module for basesystem 15	`4.3.5-6.3.1`	Not reported	SUSE-SU-2019:2657-1	Not reported
Suse	dhcp	rpm	linux enterprise module for basesystem 15 sp1	`4.3.5-6.3.1`	Not reported	SUSE-SU-2019:2657-1	Not reported
Suse	dhcp	rpm	linux enterprise module for server applications 15	`4.3.5-6.3.1`	Not reported	SUSE-SU-2019:2657-1	Not reported
Suse	dhcp	rpm	linux enterprise module for server applications 15 sp1	`4.3.5-6.3.1`	Not reported	SUSE-SU-2019:2657-1	Not reported
Opensuse	dhcp	rpm	leap 15.0	`4.3.5-lp150.5.3.1`	Not reported	OPENSUSE-SU-2019:2340-1	Not reported
Opensuse	dhcp	rpm	leap 15.1	`4.3.5-lp151.6.3.1`	Not reported	OPENSUSE-SU-2019:2341-1	Not reported
Suse	dhcp	rpm	linux enterprise desktop 12 sp4	`4.3.3-10.19.1`	Not reported	SUSE-SU-2019:2727-1	Not reported
Suse	dhcp	rpm	linux enterprise software development kit 12 sp4	`4.3.3-10.19.1`	Not reported	SUSE-SU-2019:2727-1	Not reported
Suse	dhcp	rpm	linux enterprise server 12 sp4	`4.3.3-10.19.1`	Not reported	SUSE-SU-2019:2727-1	Not reported
Suse	dhcp	rpm	linux enterprise server for sap applications 12 sp4	`4.3.3-10.19.1`	Not reported	SUSE-SU-2019:2727-1	Not reported

[Debian bug #896122]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[isc-dhcp-client]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
[isc-dhcp-client-ddns]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
[isc-dhcp-common]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
[isc-dhcp-dev]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
[isc-dhcp-relay]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
[isc-dhcp-server]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
[isc-dhcp-server-ldap]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · bookworm; dsa · isc-dhcp · debian · 12

[Debian 13 (Trixie)]

[isc-dhcp-client]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-8 · amd64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
- 4.4.3-P1-8 · arm64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
[isc-dhcp-client-ddns]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-8 · amd64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
- 4.4.3-P1-8 · arm64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
[isc-dhcp-common]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-8 · amd64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
- 4.4.3-P1-8 · arm64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
[isc-dhcp-dev]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-8 · amd64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
- 4.4.3-P1-8 · arm64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
[isc-dhcp-keama]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-8 · amd64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
- 4.4.3-P1-8 · arm64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
[isc-dhcp-relay]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-8 · amd64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
- 4.4.3-P1-8 · arm64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
[isc-dhcp-server]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-8 · amd64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
- 4.4.3-P1-8 · arm64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
[isc-dhcp-server-ldap]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-8 · amd64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13
- 4.4.3-P1-8 · arm64 · trixie
  Fixed · Fixed: 4.4.1-2
  dsa · isc-dhcp · debian · 13

Observed: Oct 23, 2026, 5:44:52 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]