CVE-2016-2774
MediumISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.
Published Mar 9, 2016 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2016-2774, DLA-2003-1, SUSE-SU-2016:1692-1, SUSE-SU-2016:1735-1, SUSE-SU-2016:1791-1, SUSE-SU-2016:2024-1, UBUNTU-CVE-2016-2774, USN-3586-1
Key Facts
Patch immediately- CVE-2016-2774 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Dhcp (Isc), Ubuntu Linux (Canonical), Debian Linux and 9 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 74% probability of exploitation in the next 30 days.
- Fixed versions are available, including dhclient 12:4.2.5-47.0.1.el7, Dhcp 12:4.2.5-47.0.1.el7, Dhcp 12:4.2.5-47.el7.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
74%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2016-2774 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.
Affected Products
195 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| DhcpIsc | 4.1.0, 4.1.0-a1, 4.1.0-a2, 4.1.0-b1, 4.1.1, 4.1.1-b1, 4.1.1-b2, 4.1.1-b3 | 12:4.2.5-47.0.1.el7 |
| Ubuntu LinuxCanonical | 14.04, 16.04, 17.10 | n/a |
| Debian LinuxDebian | 8.0 | n/a |
| isc-dhcpdebian | See advisory | 4.3.4-1 |
| dhclientoracle | See advisory | 12:4.2.5-47.0.1.el7 |
Patched Releases
dhclient
12:4.2.5-47.0.1.el7
Dhcp
12:4.2.5-47.0.1.el7, 12:4.2.5-47.el7, 4.2.4.P2-0.11.15.1, 4.2.4.P2-0.27.1, 4.2.6-14.6.1, 4.3.3-7.1, 4.3.3-9.1
dhcp-client
4.2.4.P2-0.11.15.1, 4.2.4.P2-0.27.1, 4.2.6-14.6.1, 4.3.3-7.1, 4.3.3-9.1
dhcp-common
12:4.2.5-47.0.1.el7
dhcp-devel
12:4.2.5-47.0.1.el7, 4.2.4.P2-0.27.1, 4.2.6-14.6.1, 4.3.3-7.1, 4.3.3-9.1
dhcp-doc
4.3.3-7.1
dhcp-libs
12:4.2.5-47.0.1.el7
dhcp-relay
4.2.4.P2-0.11.15.1, 4.2.4.P2-0.27.1, 4.2.6-14.6.1, 4.3.3-7.1, 4.3.3-9.1
dhcp-server
4.2.4.P2-0.11.15.1, 4.2.4.P2-0.27.1, 4.2.6-14.6.1, 4.3.3-7.1, 4.3.3-9.1
isc-dhcp
4.2.4-7ubuntu12.12, 4.3.1-6+deb8u4, 4.3.3-5ubuntu12.9, 4.3.4-1
Timeline
Publicly disclosed
Mar 9, 2016
Last updated
Aug 4, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-400 Uncontrolled Resource Consumption
References
- advisoryFEDORA-2016-c93d49faf3
- advisoryFEDORA-2016-821f013cb1
- advisoryopenSUSE-SU-2016:1843
- advisoryRHSA-2016:2590
- advisoryRHSA-2016:2590
FAQ
Common Questions.
ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.
Affected: Dhcp (Isc) versions 4.1.0, 4.1.0-a1, 4.1.0-a2, 4.1.0-b1, 4.1.1, 4.1.1-b1, 4.1.1-b2, 4.1.1-b3; Ubuntu Linux (Canonical) versions 14.04, 16.04, 17.10; Debian Linux versions 8.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including dhclient 12:4.2.5-47.0.1.el7, Dhcp 12:4.2.5-47.0.1.el7, Dhcp 12:4.2.5-47.el7.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2016-2774 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo