Is CVE-2026-71401 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71401 being exploited in the wild.

How severe is CVE-2026-71401?

Informational severity, with a CVSS score of 5.7, published 27 August 2026.

Which products and versions are affected?

Opensuse Wicked up to and including 0.6.80.

Is there a fix for CVE-2026-71401?

A patch was published on 2026-08-27: Fix merged in GitHub PR #1079 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71401 attacked?

It is attacked from the adjacent network, in a hosted service.

Am I affected by CVE-2026-71401?

Check whether you run Opensuse Wicked at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71401: wicked integer underflow in DHCPv4 packet capture

CVE-2026-71401 · Severity: info · CVSS 5.7 · Published 2026-08-27

wicked is a network configuration daemon used in Linux systems to manage network interfaces and DHCP. An integer underflow vulnerability in the DHCPv4 packet capture code can allow an attacker on the same network to send malformed packets that cause the DHCP client daemon to crash, resulting in network configuration service disruption. No data exposure has been demonstrated, but the service disruption could prevent systems from obtaining or maintaining network connectivity.

Technologies: Opensuse Wicked. Vendors: Opensuse.

Quick answers

Is CVE-2026-71401 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71401 being exploited in the wild.
How severe is CVE-2026-71401?: Informational severity, with a CVSS score of 5.7, published 27 August 2026.
Which products and versions are affected?: Opensuse Wicked up to and including 0.6.80.
Is there a fix for CVE-2026-71401?: A patch was published on 2026-08-27: Fix merged in GitHub PR #1079 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71401 attacked?: It is attacked from the adjacent network, in a hosted service.
Am I affected by CVE-2026-71401?: Check whether you run Opensuse Wicked at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an integer underflow in the ni_capture_inspect_udp_header() function in src/capture.c of wicked. The function fails to validate that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before performing subtraction, leading to integer underflow of a size_t variable that is later truncated to uint16_t for UDP checksum validation. An unauthenticated attacker on the adjacent network can craft malformed DHCPv4 packets with invalid IP header lengths to trigger out-of-bounds reads past the receive buffer in the wickedd-dhcp4 daemon. Depending on memory layout and content, this can cause the daemon to crash, resulting in denial of service. The vulnerability affects wicked versions up to and including 0.6.80, and fixes are available in the project repository as of August 2026.

Affected products

openSUSE wicked up to and including 0.6.80

Timeline

2026-08-27: disclosed: CVE-2026-71401 published
2026-08-27: patched: Fix merged in GitHub PR #1079

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.