CVE catalog

CVE-2026-115863

connman: CVE-2026-115863

Severity: Medium
Published: Oct 23, 2026, 6:17:21 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.30% · Oct 25, 2026

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	connman	sid	`2.0-2`	vulnerable
Debian	connman	forky	`2.0-2`	vulnerable
Debian	connman	trixie	`1.44-3`	vulnerable
Debian	connman	bookworm	`1.41-3`	vulnerable
Ubuntu	connman	pro	`1.35-1`	vulnerable
Ubuntu	connman	pro	`1.35-2`	vulnerable
Ubuntu	connman	pro	`1.35-6`	vulnerable
Ubuntu	connman	pro	`1.35-6ubuntu0.1~esm1`	vulnerable
Ubuntu	connman	20.04	`1.36-2build1`	vulnerable
Ubuntu	connman	20.04	`1.36-2ubuntu0.1`	vulnerable
Ubuntu	connman	22.04	`1.36-2.2build1`	vulnerable
Ubuntu	connman	22.04	`1.36-2.3`	vulnerable
Ubuntu	connman	22.04	`1.36-2.3build1`	vulnerable
Ubuntu	connman	22.04	`1.36-2.3ubuntu0.1`	vulnerable
Ubuntu	connman	24.04	`1.41-3`	vulnerable
Ubuntu	connman	24.04	`1.42-1`	vulnerable
Ubuntu	connman	24.04	`1.42-3`	vulnerable
Ubuntu	connman	24.04	`1.42-5`	vulnerable
Ubuntu	connman	24.04	`1.42-5build2`	vulnerable
Ubuntu	connman	24.04	`1.42-5build3`	vulnerable
Ubuntu	connman	26.10	`1.45-3`	vulnerable
Ubuntu	connman	26.10	`2.0-2`	vulnerable
Ubuntu	connman	26.04	`1.44-3`	vulnerable
Ubuntu	connman	26.04	`1.45-2`	vulnerable
Ubuntu	connman	26.04	`1.45-3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	connman	source	sid	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	connman	source	forky	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	connman	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	connman	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[trixie] connman: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[connman]Affected
Details (2)
- 1.41-3 · amd64 · bookworm
  Affected
  dsa · connman · debian · bookworm; dsa · connman · debian · 12
- 1.41-3 · arm64 · bookworm
  Affected
  dsa · connman · debian · bookworm; dsa · connman · debian · 12
[connman-dev]Affected
Source package: [connman]
Details (2)
- 1.41-3 · amd64 · bookworm
  Affected
  dsa · connman · debian · bookworm; dsa · connman · debian · 12
- 1.41-3 · arm64 · bookworm
  Affected
  dsa · connman · debian · bookworm; dsa · connman · debian · 12
[connman-doc]Affected
Source package: [connman]
Details (2)
- 1.41-3 · all · bookworm
  Affected
  dsa · connman · debian · bookworm; dsa · connman · debian · 12
- 1.41-3 · all · bookworm
  Affected
  dsa · connman · debian · bookworm; dsa · connman · debian · 12
[connman-vpn]Affected
Source package: [connman]
Details (2)
- 1.41-3 · amd64 · bookworm
  Affected
  dsa · connman · debian · bookworm; dsa · connman · debian · 12
- 1.41-3 · arm64 · bookworm
  Affected
  dsa · connman · debian · bookworm; dsa · connman · debian · 12

[Debian 13 (Trixie)]

[connman]Affected
Details (2)
- 1.44-3 · amd64 · trixie
  Affected
  dsa · connman · debian · 13
- 1.44-3 · arm64 · trixie
  Affected
  dsa · connman · debian · 13
[connman-dev]Affected
Source package: [connman]
Details (2)
- 1.44-3 · amd64 · trixie
  Affected
  dsa · connman · debian · 13
- 1.44-3 · arm64 · trixie
  Affected
  dsa · connman · debian · 13
[connman-doc]Affected
Source package: [connman]
Details (2)
- 1.44-3 · all · trixie
  Affected
  dsa · connman · debian · 13
- 1.44-3 · all · trixie
  Affected
  dsa · connman · debian · 13
[connman-tests]Affected
Source package: [connman]
Details (2)
- 1.44-3 · all · trixie
  Affected
  dsa · connman · debian · 13
- 1.44-3 · all · trixie
  Affected
  dsa · connman · debian · 13
[connman-vpn]Affected
Source package: [connman]
Details (2)
- 1.44-3 · amd64 · trixie
  Affected
  dsa · connman · debian · 13
- 1.44-3 · arm64 · trixie
  Affected
  dsa · connman · debian · 13

Observed: Oct 27, 2026, 4:32:57 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]