Threats affecting pkg:github/wicked

CVE-2026-71401 is an integer underflow vulnerability in the DHCPv4 packet capture code of SUSE wicked. The function ni_capture_inspect_udp_header() does not properly verify that the IP total length is at least as large as the IP header length before performing a subtraction, leading to an out-of-bounds read. An unauthenticated attacker on the same network can exploit this to crash the wicked DHCPv4 client daemon. No information disclosure or other impacts have been demonstrated. This affects wicked versions up to and including 0.6.80.

CVE-2026-71402 is a medium-severity out-of-bounds read vulnerability in the DHCPv4 packet capture code of SUSE wicked up to version 0.6.80. The flaw occurs because the function ni_capture_inspect_udp_header() incorrectly reports the IP total length as the payload length, causing the DHCPv4 client to read up to 68 bytes beyond the end of the packet buffer. An unauthenticated attacker on the same network can send a crafted DHCP/UDP packet to trigger this over-read, potentially causing the client to interpret adjacent heap memory as DHCP options. No memory writes or remote data exfiltration have been demonstrated. No official fix or patch information is currently available.

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.