# CVE-2026-55606: odhcpd out-of-bounds read in DHCPv6 self-loop detection

Source: https://junglewise.ai/threats/cve-2026-55606-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-55606 · Severity: medium · CVSS 6.5 · Published 2026-10-23

odhcpd is a DHCPv6, DHCPv4, and router advertisement server used in OpenWrt routers. A flaw in its DHCPv6 self-loop detection allows an unauthenticated attacker to send a crafted DHCPv6 packet that triggers a read of sensitive stack memory from the router, potentially exposing configuration data or cryptographic material.

Technologies: [OpenWrt Odhcpd](https://junglewise.ai/threats/technologies/odhcpd). Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-55606 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55606 being exploited in the wild.

**How severe is CVE-2026-55606?** Medium severity, with a CVSS score of 6.5, published 23 October 2026.

**Which products and versions are affected?** OpenWrt Odhcpd 25.12 and prior.

**Is there a fix for CVE-2026-55606?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55606 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55606?** Check whether you run OpenWrt Odhcpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds read in dhcpv6.c:720 where a network-byte-order DUID length value is passed directly to memcmp() instead of being converted to host byte order. On little-endian systems, this causes memcmp() to read up to 3584 bytes from a 128–130 byte stack buffer. An unauthenticated attacker can trigger this via a single crafted DHCPv6 packet. The fix requires converting the length using ntohs() before passing it to memcmp().

## Affected products

- OpenWrt odhcpd 25.12 and prior

## Timeline

- 2026-10-23: disclosed

## References

- [https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f](https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f)
- [https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301](https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301)

## Related threats

- [odhcpd DHCPv6 stack buffer overflow in IA response handler](https://junglewise.ai/threats/cve-2026-53921-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd DHCPv6 IA parser stack buffer overread](https://junglewise.ai/threats/cve-2026-53920-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd heap-use-after-free in DHCPv6 IA handler](https://junglewise.ai/threats/cve-2026-53918-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)
- [odhcpd integer underflow in DHCPv6 IA handling](https://junglewise.ai/threats/cve-2026-53922-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used)