{"id":"GO-2026-6237","title":"Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp","summary":"Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp","severity":"none","vendor":"insomniacslk","product":"github.com/insomniacslk/dhcp","ecosystem":"go","affected":["github.com/insomniacslk/dhcp < 0.0.0-20260719225207-c76316d4aa82"],"patched":["github.com/insomniacslk/dhcp 0.0.0-20260719225207-c76316d4aa82"],"published":"2026-08-18","updated":"2026-08-18","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6237","references":[{"url":"https://github.com/insomniacslk/dhcp/commit/c76316d4aa825673b208730779843d0711021e81"}],"tags":["osv","go"],"ingestedAt":"2026-08-18T19:21:40.289Z","slug":"GO-2026-6237","body":"## Overview\n\nIn github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in a negative DHCP length, causing a panic in buf.Consume due to a negative slice bound.\n\n## Affected packages\n\n- `github.com/insomniacslk/dhcp < 0.0.0-20260719225207-c76316d4aa82`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/insomniacslk/dhcp 0.0.0-20260719225207-c76316d4aa82`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}