| CVE-2026-3608 |
Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any…
|
7.5
High
|
Mar 25, 2026 |
| CVE-2025-11232 |
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at…
|
7.5
High
|
Oct 29, 2025 |
| CVE-2025-40779 |
If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the…
|
7.5
High
|
Aug 27, 2025 |
| CVE-2025-32803 |
In some cases, Kea log files or lease files may be world-readable
|
4.0
Medium
|
May 28, 2025 |
| CVE-2025-32802 |
Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea
|
6.1
Medium
|
May 28, 2025 |
| CVE-2025-32801 |
Kea configuration and API directives can be used to load a malicious hook library
|
7.8
High
|
May 28, 2025 |
| CVE-2019-6474 |
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage…
|
5.7
Medium
|
Oct 16, 2019 |
| CVE-2019-6473 |
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the…
|
6.5
Medium
|
Oct 16, 2019 |
| CVE-2019-6472 |
A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion…
|
6.5
Medium
|
Oct 16, 2019 |