Kea vulnerabilities

4 known vulnerabilities in Kea from ISC. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Kea: Reachable Assertion

  CVE-2026-3608Mar 25, 2026ISCEPSS 1.42%

  Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0

• 7.5 High severity

  Kea: Use of Out-of-range Pointer Offset

  CVE-2025-11232Oct 29, 2025ISC

  To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NO

• 7.5 High severity

  Kea: NULL Pointer Dereference

  CVE-2025-40779Aug 27, 2025ISC

  If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort with an assertion failure. This happens only if the client request is unicast directly to Kea; broadca

• 7.8 High severity

  Kea: Improper Control of Generation of Code

  CVE-2025-32801May 28, 2025ISC

  Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions