CVE catalog

CVE-2022-2929

isc-dhcp: CVE-2022-2929

Severity: Medium · CVSS 6.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Oct 5, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.66% · Oct 25, 2026

In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	isc-dhcp	trixie	`4.4.3-P1-8`	fixed
Debian	isc-dhcp	bookworm	`4.4.3-P1-2`	fixed
Ubuntu	isc-dhcp	pro	`4.3.1-5ubuntu3`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.1-5ubuntu4`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.1-5ubuntu5`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu1`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu2`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu4`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu5`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu7`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu8`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu9`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu10`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu11`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12.1`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12.3`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12.4`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12.6`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12.7`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12.9`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12.10`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12.10+esm1`	vulnerable
Ubuntu	isc-dhcp	pro	`4.3.3-5ubuntu12.10+esm2`	fixed
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu2`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu3`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu4`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu5`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu6`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu7`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu7.1`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu7.2`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu7.3`	vulnerable
Ubuntu	isc-dhcp	18.04	`4.3.5-3ubuntu7.4`	fixed
Ubuntu	isc-dhcp	20.04	`4.4.1-2ubuntu5`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2ubuntu6`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2.1ubuntu1`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2.1ubuntu2`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2.1ubuntu3`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2.1ubuntu4`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2.1ubuntu5`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2.1ubuntu5.20.04.1`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2.1ubuntu5.20.04.2`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2.1ubuntu5.20.04.3`	vulnerable
Ubuntu	isc-dhcp	20.04	`4.4.1-2.1ubuntu5.20.04.4`	fixed
Ubuntu	isc-dhcp	22.04	`4.4.1-2.3ubuntu1`	vulnerable
Ubuntu	isc-dhcp	22.04	`4.4.1-2.3ubuntu2`	vulnerable
Ubuntu	isc-dhcp	22.04	`4.4.1-2.3ubuntu2.1`	vulnerable
Ubuntu	isc-dhcp	22.04	`4.4.1-2.3ubuntu2.2`	vulnerable
Ubuntu	isc-dhcp	22.04	`4.4.1-2.3ubuntu2.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	isc-dhcp	source	trixie	`4.4.3-2.1`	not yet assigned	Not reported	[1021320]
Debian	isc-dhcp	source	bookworm	`4.4.3-2.1`	not yet assigned	Not reported	[1021320]
Ubuntu	isc-dhcp	deb	pro	`4.3.3-5ubuntu12.10+esm2`	Not reported	UBUNTU-CVE-2022-2929	Not reported
Ubuntu	isc-dhcp	deb	18.04	`4.3.5-3ubuntu7.4`	Not reported	UBUNTU-CVE-2022-2929	Not reported
Ubuntu	isc-dhcp	deb	20.04	`4.4.1-2.1ubuntu5.20.04.4`	Not reported	UBUNTU-CVE-2022-2929	Not reported
Ubuntu	isc-dhcp	deb	22.04	`4.4.1-2.3ubuntu2.3`	Not reported	UBUNTU-CVE-2022-2929	Not reported

[Debian bug #1021320]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[isc-dhcp-client]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
[isc-dhcp-client-ddns]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
[isc-dhcp-common]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
[isc-dhcp-dev]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
[isc-dhcp-relay]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
[isc-dhcp-server]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
[isc-dhcp-server-ldap]Fixed
Source package: [isc-dhcp]
Details (2)
- 4.4.3-P1-2 · amd64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm
- 4.4.3-P1-2 · arm64 · bookworm
  Fixed · Fixed: 4.4.3-2.1
  dsa · isc-dhcp · debian · bookworm

Observed: Oct 23, 2026, 6:26:15 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]