# CVE-2026-18103: dhcp-server buffer overflow in OMAPI handler

Source: https://junglewise.ai/threats/cve-2026-18103-dhcp-server-buffer-overflow-in-omapi-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18103 · Severity: medium · CVSS 4.9 · Published 2026-08-05

The DHCP server is a critical network service that assigns IP addresses to devices. This flaw allows a remote attacker with access to the management port to crash the DHCP service through a specially crafted request, preventing new devices from connecting to the network until an administrator manually restarts the service. The risk is highest for installations where the management port is not properly restricted or authenticated.

Vendors: [Isc](https://junglewise.ai/threats/vendors/isc).

## Quick answers

**Is CVE-2026-18103 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18103 being exploited in the wild.

**How severe is CVE-2026-18103?** Medium severity, with a CVSS score of 4.9, published 5 August 2026.

**Which products and versions are affected?** Isc Dhcp-Server <UNKNOWN>.

**Is there a fix for CVE-2026-18103?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18103 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18103?** Check whether you run Isc Dhcp-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow vulnerability exists in the dhcp-server's OMAPI (Open Management Application Programming Interface) handler, specifically in the print_hw_addr() function when processing an overly long InfiniBand MAC address during lease creation. The vulnerability is triggered via network access to the OMAPI port (7911) and requires high privileges (TSIG key authentication must be disabled or bypassed) but no user interaction. Successful exploitation causes the dhcpd service to crash and prevents automatic restart, resulting in persistent denial of service. The vulnerability is classified as CWE-120 (classic buffer overflow) with no remote code execution impact.

## Affected products

- ISC dhcp-server <UNKNOWN>

## Timeline

- 2026-08-05: disclosed
- 2026-08-05: advisory

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-18103](https://access.redhat.com/security/cve/CVE-2026-18103)