Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade kea | May 25, 2026 | Mar 25, 2026 |
| Debian | — | Upgrade isc-kea | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kea-docUpgrade kea-libsUpgrade kea-keamaUpgrade keaUpgrade kea-hooks | Apr 22, 2026 | Mar 25, 2026 |
| Redhat_linux | — | Upgrade keaUpgrade kea-libs-debuginfoUpgrade kea-hooks-debuginfoUpgrade kea-debugsourceUpgrade kea-keamaUpgrade kea-libsUpgrade kea-devel-debuginfoUpgrade kea-hooksUpgrade kea-keama-debuginfoUpgrade kea-docUpgrade kea-debuginfo | Apr 13, 2026 | Mar 25, 2026 |
| Rocky_linux | — | Upgrade kea-debuginfoUpgrade kea-debugsourceUpgrade keaUpgrade kea-keama-debuginfoUpgrade kea-libsUpgrade kea-libs-debuginfoUpgrade kea-hooks-debuginfoUpgrade kea-keamaUpgrade kea-hooks | Apr 13, 2026 | Apr 11, 2026 |
| Suse | — | Upgrade kea-hooksUpgrade libkea-database62Upgrade libkea-stats53Upgrade libkea-log75Upgrade libkea-config84Upgrade libkea-d2srv63Upgrade libkea-pgsql88Upgrade libkea-dhcp_ddns68Upgrade libkea-asiodns49Upgrade libkea-hooks121Upgrade libkea-process76Upgrade libkea-log61Upgrade libkea-tcp19Upgrade libkea-stats41Upgrade keaUpgrade libkea-cfgclient67Upgrade libkea-tcp33Upgrade libkea-util102Upgrade kea-develUpgrade libkea-dhcpsrv131Upgrade libkea-cfgrpt3Upgrade kea-docUpgrade libkea-dhcp_ddns57Upgrade libkea-util-io12Upgrade libkea-util-io0Upgrade libkea-eval69Upgrade libkea-d2srv47Upgrade libkea-cc69Upgrade libkea-http87Upgrade libkea-cryptolink50Upgrade libkea-cc83Upgrade libkea-asiolink72Upgrade libkea-dhcp++92Upgrade libkea-mysql88Upgrade libkea-dns++57Upgrade libkea-cryptolink64Upgrade libkea-asiodns62Upgrade libkea-dns71Upgrade libkea-eval84Upgrade libkea-dhcpsrv112Upgrade libkea-hooks102Upgrade libkea-log-interprocess3Upgrade libkea-mysql71Upgrade libkea-http72Upgrade libkea-exceptions45Upgrade libkea-database76Upgrade libkea-util87Upgrade libkea-dhcp109Upgrade libkea-asiolink88Upgrade python3-keaUpgrade libkea-process91Upgrade libkea-pgsql71Upgrade libkea-exceptions33 | Apr 3, 2026 | Apr 3, 2026 |
| Ubuntu | — | Upgrade kea-dhcp6-serverUpgrade kea-dhcp4-serverUpgrade kea-commonUpgrade kea-dhcp-ddns-serverUpgrade kea-admin | Jun 9, 2026 | Jun 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub