Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade kea | May 25, 2026 | Mar 25, 2026 |
| Debian | — | Upgrade isc-kea | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kea-keamaUpgrade kea-hooksUpgrade keaUpgrade kea-libsUpgrade kea-doc | Apr 22, 2026 | Mar 25, 2026 |
| Redhat_linux | — | Upgrade kea-debugsourceUpgrade keaUpgrade kea-libs-debuginfoUpgrade kea-hooks-debuginfoUpgrade kea-devel-debuginfoUpgrade kea-debuginfoUpgrade kea-keamaUpgrade kea-keama-debuginfoUpgrade kea-hooksUpgrade kea-docUpgrade kea-libs | Apr 13, 2026 | Mar 25, 2026 |
| Rocky_linux | — | Upgrade kea-hooks-debuginfoUpgrade kea-libsUpgrade kea-libs-debuginfoUpgrade kea-keamaUpgrade kea-hooksUpgrade kea-keama-debuginfoUpgrade kea-debuginfoUpgrade keaUpgrade kea-debugsource | Apr 13, 2026 | Apr 11, 2026 |
| Suse | — | Upgrade libkea-dns71Upgrade libkea-cc83Upgrade libkea-dhcp++92Upgrade libkea-exceptions33Upgrade libkea-exceptions45Upgrade libkea-mysql71Upgrade libkea-pgsql71Upgrade libkea-http72Upgrade libkea-mysql88Upgrade python3-keaUpgrade libkea-dhcpsrv112Upgrade libkea-hooks102Upgrade libkea-dns++57Upgrade libkea-asiodns62Upgrade libkea-asiolink88Upgrade libkea-cryptolink64Upgrade libkea-eval84Upgrade libkea-dhcp109Upgrade libkea-util87Upgrade libkea-database76Upgrade libkea-process91Upgrade libkea-asiolink72Upgrade libkea-log-interprocess3Upgrade libkea-cryptolink50Upgrade libkea-util102Upgrade libkea-cc69Upgrade libkea-tcp33Upgrade libkea-stats53Upgrade libkea-dhcpsrv131Upgrade libkea-dhcp_ddns57Upgrade kea-hooksUpgrade libkea-log75Upgrade libkea-cfgclient67Upgrade libkea-asiodns49Upgrade libkea-database62Upgrade libkea-http87Upgrade libkea-hooks121Upgrade libkea-dhcp_ddns68Upgrade libkea-process76Upgrade libkea-pgsql88Upgrade kea-develUpgrade keaUpgrade libkea-tcp19Upgrade libkea-log61Upgrade libkea-eval69Upgrade libkea-d2srv47Upgrade libkea-cfgrpt3Upgrade kea-docUpgrade libkea-util-io12Upgrade libkea-util-io0Upgrade libkea-d2srv63Upgrade libkea-config84Upgrade libkea-stats41 | Apr 3, 2026 | Apr 3, 2026 |
| Ubuntu | — | Upgrade kea-dhcp-ddns-serverUpgrade kea-adminUpgrade kea-dhcp6-serverUpgrade kea-commonUpgrade kea-dhcp4-server | Jun 9, 2026 | Jun 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub