CVE-2026-42511
HighSummary
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, a malicious field may be passed to dhclient-script(8), which evaluates it.
Risk Assessment
A rogue DHCP server may be able to execute arbitrary code as root on a system running dhclient, posing a significant security risk.
Recommendation
It is recommended to update dhclient to the latest version and implement strict controls over DHCP servers in the network to minimize the risk of attack.
Other vulnerabilities in dhclient
Original NVD description (English source)
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it. A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient.