x/vulndb: suggestion regarding GO-2026-6237

[thc1006]

Thanks for adding GO-2026-6237. I would like to suggest three updates to the report.

Credit

Please add Hsiu-Chi Tsai (@thc1006) to the report credits. I reported the issue to the upstream maintainer and authored the merged fix and regression tests in PR #583.

• nclient4: reject frames whose IPv4 payload cannot hold a UDP header insomniacslk/dhcp#583
• insomniacslk/dhcp@c76316d

Fix reference

Please add PR #583 as a FIX or WEB reference in addition to the merge commit. The PR contains the root-cause analysis, the payload-length guard, and the regression tests covering the boundary cases and continued reading after a malformed frame is skipped.

Introduced version

The generated OSV range currently starts at introduced: 0. However, the vulnerable subtraction-and-Consume path appears to have been introduced by commit 5dce45b2b680c398f6052c14c0f7558add495130 on 2019-05-22:

insomniacslk/dhcp@5dce45b

That commit changed the return path from buf.ReadAll() to:

dhcpLen := int(ipHdr.PayloadLength()) - udpHdrLen
return copy(b, buf.Consume(dhcpLen)), srcAddr, nil

This is the calculation that can produce a negative DHCP length for an IPv4 payload shorter than the UDP header.

Could you verify the canonical Go pseudo-version corresponding to that commit and use it as the introduced boundary if appropriate, rather than treating all earlier module versions as affected?

Thank you.