CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-40779 – Kea crash upon interaction between specific client options and subnet selection
https://notcve.org/view.php?id=CVE-2025-40779
27 Aug 2025 — If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort with an assertion failure. This happens only if the client request is unicast directly to Kea; broadcast messages do not cause the problem. This issue affects Kea versions 2.7.1 through 2.7.9, 3.0.0, and 3.1.0. If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` proc... • https://kb.isc.org/docs/cve-2025-40779 • CWE-476: NULL Pointer Dereference •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2025-32803 – Insecure file permissions can result in confidential information leakage
https://notcve.org/view.php?id=CVE-2025-32803
28 May 2025 — In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8. A vulnerability was found in the Kea package, where an attacker with access to a local unprivileged user may be able to read the logs and DHCP lease information. This can be used to retrieve sensitive information about the DHCP clients and about the Kea process itself. In some cases, Kea log files or lease files may be world-readable. This issu... • https://kb.isc.org/docs/cve-2025-32803 • CWE-276: Incorrect Default Permissions CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-32802 – Insecure handling of file paths allows multiple local attacks
https://notcve.org/view.php?id=CVE-2025-32802
28 May 2025 — Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8. A vulnerability was found in the Kea package. If an attacker has access to a local user account and the Kea API entry points are not secured, the atta... • https://kb.isc.org/docs/cve-2025-32802 • CWE-73: External Control of File Name or Path CWE-250: Execution with Unnecessary Privileges CWE-379: Creation of Temporary File in Directory with Insecure Permissions •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-32801 – Loading a malicious hook library can lead to local privilege escalation
https://notcve.org/view.php?id=CVE-2025-32801
28 May 2025 — Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8. A flaw was found in the Kea package, where an unprivileged user can instruct Kea to load a hook library from any arbitrary local file. This hook can then be executed using the same priv... • https://kb.isc.org/docs/cve-2025-32801 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-267: Privilege Defined With Unsafe Actions •
CVSS: 6.5EPSS: 1%CPEs: 3EXPL: 0CVE-2019-6474 – A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate
https://notcve.org/view.php?id=CVE-2019-6474
16 Oct 2019 — A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2 Una falta de comprobación en las peticiones de cl... • https://kb.isc.org/docs/cve-2019-6474 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-6472 – A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate
https://notcve.org/view.php?id=CVE-2019-6472
16 Oct 2019 — A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2. Un paquete que contiene un DUID malformado puede hacer que el proceso del servidor Kea DHCPv6 (kea-dhcp6) se cierre debido a un error de aserción. Versiones afectadas: 1.4.0 hasta 1.5.0, 1.6.0-beta1 y 1.6.0-beta2. • https://kb.isc.org/docs/cve-2019-6472 • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2018-5739 – Failure to release memory may exhaust system resources
https://notcve.org/view.php?id=CVE-2018-5739
16 Jan 2019 — An extension to hooks capabilities which debuted in Kea 1.4.0 introduced a memory leak for operators who are using certain hooks library facilities. In order to support multiple requests simultaneously, Kea 1.4 added a callout handle store but unfortunately the initial implementation of this store does not properly free memory in every case. Hooks which make use of query4 or query6 parameters in their callouts can leak memory, resulting in the eventual exhaustion of available memory and subsequent failure o... • https://kb.isc.org/docs/aa-01626 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.1EPSS: 3%CPEs: 2EXPL: 0CVE-2015-8373
https://notcve.org/view.php?id=CVE-2015-8373
22 Dec 2015 — The kea-dhcp4 and kea-dhcp6 servers 0.9.2 and 1.0.0-beta in ISC Kea, when certain debugging settings are used, allow remote attackers to cause a denial of service (daemon crash) via a malformed packet. Los servidores kea-dhcp4 y kea-dhcp6 0.9.2 y 1.0.0-beta en ISC Kea, cuando se usan ciertas configuraciones de depuración, permiten a atacantes remotos causar una denegación de servicio (caída de demonio) a través de un paquete mal formado. • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175218.html • CWE-20: Improper Input Validation •