Security

lldpd contains several security features to mitigate vulnerabilities (privilege separation, chrooted process, …). If you wish to report a security issue, either open an issue on GitHub or mail me directly.

Past vulnerabilities

• GHSA-jmrh-hxvj-p42g: heap out-of-bound read in liblldpctl when displaying an LLDP-MED location or a chassis or port ID with the address subtype. A remote device can send a malformed LLDP-MED location or address and the client reading it may crash or display bytes from its own memory. The lldpd daemon is not affected. For LLDP-MED locations, lldpcli is not affected either, only third-party programs using liblldpctl to read the location keys. For chassis and port IDs, lldpcli is affected. These bugs have been fixed in commits 587da0859d85 and f39254f3ef37 and in version 1.0.23. They have been discovered by Ali Firas.

• CVE-2026-46433: heap out-of-bound read when decapsulating VLAN. This vulnerability affects the parser, which is run in an unprivileged and chrooted process. It does not allow arbitrary code execution but may crash the process if ASan is enabled. This bug has been fixed in commit ca931be63a9c and in version 1.0.22. It has been discovered by TristanInSec.

• CVE-2021-43612: heap overflow when parsing too short SONMP packets. This vulnerability affects the parser which is run in an unprivileged and chrooted process. It does not allow arbitrary code execution. This bug has been fixed in commit 73d42680 and in version 1.0.13. It has been discovered by Jeremy Galindo.

• CVE-2020-27827: memory exhaustion attack through crafted LLDPU with duplicate TLVs. A remote device can send LLDPU with a duplicate port description, system name, or system description TLV and trigger a memory leak. The vulnerability does not allow arbitrary code execution. This bug is present since the initial release. It has been fixed in commits a8d3c90f (1.0.8), and 7d60bf30 (1.0.9).

• CVE-2015-8011: buffer overflow when handling management address TLV for LLDP. When a remote device was advertising a too large management address while still respecting TLV boundaries, lldpd would crash due to a buffer overflow. This vulnerability affects the parser which is run in an unprivileged and chrooted process. It does not allow arbitrary code execution unless hardening has been specifically disabled. This bug has been introduced in version 0.6.0. It has been fixed in commit dd4f16e7 and in version 0.7.19.

• CVE-2015-8012: crash on malformed management address. When a remote device was advertising a malformed management address, lldpd would crash with an assertion error. This vulnerability affects the parser which is run in an unprivileged and chrooted process. It does not allow arbitrary code execution. This bug has been introduced in version 0.6.0. It has been fixed in commit 793526f8 and in version 0.7.19.