Skip to content
fr Sign in
7.5 High

CVE-2025-11232 To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at…

Description

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

Affected products and versions

Product Affected versions Fixed in
Kea 3.1 3.1.1 → 3.1.2 3.1.0
Kea 3.0.1 3.0.0
Kea 2.7 earliest → < 2.7.0 2.7.0
Kea 2.6 earliest → < 2.6.0 2.6.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Kea

The 9 CVEs of Kea →
CVE-2026-3608 Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any… 7.5 High CVE-2025-40779 If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the… 7.5 High CVE-2025-32803 In some cases, Kea log files or lease files may be world-readable 4.0 Medium CVE-2025-32802 Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea 6.1 Medium
Track this CVE