---
id: GO-2026-6237
title: Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp
summary: Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp
severity: none
vendor: insomniacslk
product: github.com/insomniacslk/dhcp
ecosystem: go
affected:
  - github.com/insomniacslk/dhcp < 0.0.0-20260719225207-c76316d4aa82
patched:
  - github.com/insomniacslk/dhcp 0.0.0-20260719225207-c76316d4aa82
published: '2026-08-18'
updated: '2026-08-18'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6237'
references:
  - url: >-
      https://github.com/insomniacslk/dhcp/commit/c76316d4aa825673b208730779843d0711021e81
tags:
  - osv
  - go
ingestedAt: '2026-08-18T19:21:40.289Z'
---

## Overview

In github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in a negative DHCP length, causing a panic in buf.Consume due to a negative slice bound.

## Affected packages

- `github.com/insomniacslk/dhcp < 0.0.0-20260719225207-c76316d4aa82`

## Remediation

Upgrade to a patched release:

- `github.com/insomniacslk/dhcp 0.0.0-20260719225207-c76316d4aa82`