Odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt.

odhcpd is the

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space.

Do this now

Restrict untrusted network access to odhcpd DHCPv6 services on OpenWrt and watch for a vendor fix.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 22:17 UTC
Identifiers: CVE-2026-53921
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt.
Severity: critical. Patch status: fix status unknown.
Affected: odhcpd is the
Ids: CVE-2026-53921

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space.

## Steps
1. Search the repo, its CI and infra config for odhcpd is the. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-53921") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/openwrt/odhcpd/commit/0320032ae313452f3c8cb8725c621dd06c36dc03 https://nvd.nist.gov/vuln/detail/CVE-2026-53921
https://pwned.coffee/i/odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-ser-cve-2026-53921

Timeline

23 Oct 2026, 22:17 UTC
Proof-of-concept code for CVE-2026-53921 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee