Back Linuxsecurity

openSUSE Wicked Important DHCP Out-of-Bounds Reads Vuln 2026-3839

Linuxsecurity •LinuxSecurity Advisories • August 28, 2026

Find practical guidance for preventing, investigating, and responding to Linux security problems. Find practical guidance for preventing, investigating, and responding to Linux security problems. _ Review Linux Privileges ×

This update for wicked fixes the following issue:

* CVE-2026-71401: out-of-bounds read due to IP length underflow in checksum

handling of DHCPv4 capture parsing (bsc#1274627).

* CVE-2026-71402: out-of-bounds read due to DHCP option reader being extended

beyond provided allocation in DHCPv4 capture parsing (bsc#1274627).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server 15 SP5 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-3839=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-3839=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-3839=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-3839=1

* SUSE Linux Enterprise Micro 5.5

zypper in -t patch SUSE-SLE-Micro-5.5-2026-3839=1

zypper in -t patch SUSE-2026-3839=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)

* wicked-debuginfo-0.6.79-150500.3.47.1

* wicked-service-0.6.79-150500.3.47.1

* wicked-0.6.79-150500.3.47.1

* wicked-nbft-0.6.79-150500.3.47.1

* wicked-debugsource-0.6.79-150500.3.47.1

* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)

* wicked-debuginfo-0.6.79-150500.3.47.1

* wicked-service-0.6.79-150500.3.47.1

* wicked-0.6.79-150500.3.47.1

* wicked-nbft-0.6.79-150500.3.47.1

* wicked-debugsource-0.6.79-150500.3.47.1

* SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64)

* wicked-0.6.79-150500.3.47.1

* wicked-debuginfo-0.6.79-150500.3.47.1

* wicked-debugsource-0.6.79-150500.3.47.1

* wicked-service-0.6.79-150500.3.47.1

* openSUSE Leap 15.5 (aarch64 i586 ppc64le s390x x86_64)

* wicked-service-0.6.79-150500.3.47.1

* wicked-debuginfo-0.6.79-150500.3.47.1

* wicked-0.6.79-150500.3.47.1

* wicked-nbft-0.6.79-150500.3.47.1

* wicked-debugsource-0.6.79-150500.3.47.1

* SUSE Linux Enterprise High Performance...

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in SUSE Wicked Affecting DHCP Parsing SUSE has released important security updates addressing two critical vulnerabilities in the Wicked network management tool, identified as CVE-2026-71401 and CVE-2026-71402, both published on 2026-08-27. These vulnerabilities involve out-of-bounds reads due to IP length underflow and improper handling of DHCP options, potentially allowing attackers to exploit these flaws for unauthorized access or denial of service. The affected systems include various versions of SUSE Linux Enterprise and openSUSE. The updates are crucial for preventing potential exploits that could lead to significant security breaches. Administrators are advised to apply the patches immediately using the recommended installation methods. The vulnerabilities have been rated with CVSS scores indicating a high severity level, emphasizing the urgency of remediation. Current reports indicate that there is no confirmed active exploitation in the wild, but the potential risk remains significant. 8 sources 61

Extracted Entities

openSUSE Wicked Important DHCP Out-of-Bounds Reads Vuln 2026-3839

The full story

Extracted Entities

CVEs (2)

CWE Weaknesses (1)

Platforms (6)