High
Security advisory
Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-5732
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:19 UTC · Revision 1
Source evidence
Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0
osv:CVE-2018-5732
Complete source record
{
"id": "4533e087799b64d1566e104cdf0c6ef85c40eb76ac14caa7c0da26e93bf3ab84",
"url": "https://osv.dev/vulnerability/CVE-2018-5732",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-5732",
"summary": "Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0",
"evidence": "osv:CVE-2018-5732",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2018-5732",
"aliases": [
"CVE-2018-5732"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.isc.org/isc-projects/dhcp",
"type": "GIT",
"events": [
{
"introduced": "2a4ff20abc29fe2647de68e6a6eea8e49e6ce941"
},
{
"last_affected": "9ff9a4e8131e7b5f144050b538ff866f89c98ffc"
},
{
"introduced": "079f747eb20d40e80c65e8a984d6c50860560b3c"
},
{
"fixed": "8541c4fcbc6364800775234bacfe646ef16bfd38"
},
{
"introduced": "5de62c8b34a94e66269b39c663cd222047216306"
},
{
"fixed": "c1bd79a15e9b689e8a18538aaedec0ab8bd04b17"
},
{
"introduced": "b39dd193dc3d189d3669866d73a87172545e2a4b"
},
{
"last_affected": "075a2f45da9a3194c9ea2c72b2167d9bb5bd0c21"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:isc:dhcp:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.0"
},
{
"last_affected": "4.1.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:-:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-NA"
},
{
"last_affected": "4.1-esv-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r1"
},
{
"last_affected": "4.1-esv-r1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r10:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r10"
},
{
"last_affected": "4.1-esv-r10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r10b1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r10b1"
},
{
"last_affected": "4.1-esv-r10b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r10rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r10rc1"
},
{
"last_affected": "4.1-esv-r10rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r11:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r11"
},
{
"last_affected": "4.1-esv-r11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r11b1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r11b1"
},
{
"last_affected": "4.1-esv-r11b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r11rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r11rc1"
},
{
"last_affected": "4.1-esv-r11rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r11rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r11rc2"
},
{
"last_affected": "4.1-esv-r11rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r12:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r12"
},
{
"last_affected": "4.1-esv-r12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r12-p1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r12\\-p1"
},
{
"last_affected": "4.1-esv-r12\\-p1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r12b1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r12b1"
},
{
"last_affected": "4.1-esv-r12b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r13:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r13"
},
{
"last_affected": "4.1-esv-r13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r13b1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r13b1"
},
{
"last_affected": "4.1-esv-r13b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r14:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r14"
},
{
"last_affected": "4.1-esv-r14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r14b1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r14b1"
},
{
"last_affected": "4.1-esv-r14b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r15:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r15"
},
{
"last_affected": "4.1-esv-r15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r2:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r2"
},
{
"last_affected": "4.1-esv-r2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r3:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r3"
},
{
"last_affected": "4.1-esv-r3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r3b1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r3b1"
},
{
"last_affected": "4.1-esv-r3b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r4:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r4"
},
{
"last_affected": "4.1-esv-r4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r5:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r5"
},
{
"last_affected": "4.1-esv-r5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r5b1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r5b1"
},
{
"last_affected": "4.1-esv-r5b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r5rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r5rc1"
},
{
"last_affected": "4.1-esv-r5rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r5rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r5rc2"
},
{
"last_affected": "4.1-esv-r5rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r6:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r6"
},
{
"last_affected": "4.1-esv-r6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r7:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r7"
},
{
"last_affected": "4.1-esv-r7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r8:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r8"
},
{
"last_affected": "4.1-esv-r8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r8b1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r8b1"
},
{
"last_affected": "4.1-esv-r8b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r8rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r8rc1"
},
{
"last_affected": "4.1-esv-r8rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r9:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r9"
},
{
"last_affected": "4.1-esv-r9"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r9b1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r9b1"
},
{
"last_affected": "4.1-esv-r9b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1-esv:r9rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1-esv-r9rc1"
},
{
"last_affected": "4.1-esv-r9rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.1.2:p1:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.2-p1"
},
{
"last_affected": "4.1.2-p1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:isc:dhcp:4.4.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.4.0"
},
{
"last_affected": "4.4.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.1-esv-NA",
"4.1-esv-r1",
"4.1-esv-r10",
"4.1-esv-r10b1",
"4.1-esv-r10rc1",
"4.1-esv-r11",
"4.1-esv-r11b1",
"4.1-esv-r11rc1",
"4.1-esv-r11rc2",
"4.1-esv-r12",
"4.1-esv-r12\\-p1",
"4.1-esv-r13",
"4.1-esv-r13b1",
"4.1-esv-r14",
"4.1-esv-r14b1",
"4.1-esv-r15",
"4.1-esv-r2",
"4.1-esv-r3",
"4.1-esv-r3b1",
"4.1-esv-r4",
"4.1-esv-r5",
"4.1-esv-r5b1",
"4.1-esv-r5rc1",
"4.1-esv-r5rc2",
"4.1-esv-r6",
"4.1-esv-r7",
"4.1-esv-r8",
"4.1-esv-r8b1",
"4.1-esv-r8rc1",
"4.1-esv-r9",
"4.1-esv-r9b1",
"4.1-esv-r9rc1",
"4.1.2-p1",
"4.4.0",
"v4_4_0",
"v4_4_0b1_f1",
"v4_3_6b1",
"v4_3_5",
"v4_3_5b1",
"v4_3_4",
"v4_3_3",
"v4_3_3b1",
"v4_3_2",
"v4_2_8_rc2",
"v4_3_2rc2",
"v4_2_8rc1",
"v4_3_2rc1",
"v4_2_8b1",
"v4_3_2b1",
"v4_3_2.pre-beta",
"v4_2_7",
"v4_3_1",
"v4_3_1rc1",
"v4_2_7rc1",
"v4_2_7b1",
"v4_3_1b1",
"v4_2_6",
"v4_3_0",
"v4_2_6rc1",
"v4_2_6b1",
"v4_2_5",
"v4_2_5rc1",
"v4_2_5b1",
"v4_2_4",
"v4_2_4rc2",
"v4_2_4rc1",
"v4_2_4b1",
"v4_2_3",
"v4_2_3rc1",
"v4_2_2",
"v4_2_2rc1",
"v4_2_2b1",
"v4_1_esv_r2",
"v4_2_1_P1",
"v4_1_esv_r1",
"v4_2_1",
"v4_2_1rc1",
"v4_2_1b1",
"v4_1_esv_r0",
"v4_2_0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-5732.json"
}
}
],
"modified": "2026-10-24T10:31:05.839581086Z",
"provider": "osv",
"references": [
"https://kb.isc.org/docs/aa-01565"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-5732",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 440852,
"published_at": "2019-10-09T16:15:13.407+00:00"
}