Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache radvd: Uncontrolled Memory Access
published 3 months ago
Summary
Apache radvd's security update fixes a critical issue where a malicious ICMPv6 message could cause the software to crash or behave unexpectedly. This affects systems using radvd for network configuration. To protect your systems, apply the latest security update and ensure you're running radvd version 2.21 or higher.
What to do
- Update opensuse radvd to version 2.21-160000.1.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensuse | radvd |
< 2.21-160000.1.1 Fix: upgrade to 2.21-160000.1.1
|
Original advisory text
Security update for radvd
This update for radvd fixes the following issue
- CVE-2026-48715: crafted ICMPv6 Router Advertisement can lead to a stack-based buffer overflow (bsc#1268641).
Changes for radvd:
- Update to version 2.21.
* feat: RFC8319 support: Increase max AdvDefaultLifetime and MaxRtrAdvInterval.
* feat: Add DHCPv6-PD preferred flag.
* fix: improve file checks for procfs knobs.
* feat: allow libc strlcpy.
* fix: make libcheck fatal if missing with --with-check.
* refactor: make drop_root_privileges reusable.
* fix: support incoming jumbo packets.
* Avoid libbsd header with libc strlcpy.
- CVE-2026-48715: crafted ICMPv6 Router Advertisement can lead to a stack-based buffer overflow (bsc#1268641).
Changes for radvd:
- Update to version 2.21.
* feat: RFC8319 support: Increase max AdvDefaultLifetime and MaxRtrAdvInterval.
* feat: Add DHCPv6-PD preferred flag.
* fix: improve file checks for procfs knobs.
* feat: allow libc strlcpy.
* fix: make libcheck fatal if missing with --with-check.
* refactor: make drop_root_privileges reusable.
* fix: support incoming jumbo packets.
* Avoid libbsd header with libc strlcpy.
References
- https://bugzilla.suse.com/1268641 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-48715 URL
Timeline
Published21 Jul 2026
Updated24 Jul 2026
First seen24 Jul 2026
Sources
openSUSE-SU-2026:21400-1 · OSV
Track software like this
Free during beta