Approved changes feed: RSS · Atom
cpe:2.3:a:isc:kea:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Isc (4a2f2b37-98b6-5702-822d-72afcd17d050) |
|---|---|
| Product | Kea (53ce22d6-5f91-5354-9ad5-9b5f45680bbf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/isc-kea |
purl2cpe | 2026-06-01 10:15:10.630374 |
pkg:deb/ubuntu/isc-kea |
purl2cpe | 2026-06-01 10:15:10.630378 |
pkg:github/isc-projects/kea |
purl2cpe | 2026-06-01 10:15:10.630382 |
pkg:rpm/fedora/kea |
purl2cpe | 2026-06-01 10:15:10.630386 |
pkg:rpm/opensuse/kea |
purl2cpe | 2026-06-01 10:15:10.630390 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3608 |
vulnerable | 2026-06-08 08:01:19.053877 |
Stack overflow in Kea daemons
HIGH (7.5)
Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error.
This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.
Published: 2026-03-25T08:46:48.992Z
Updated: 2026-07-15T01:02:33.862Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-40779 |
vulnerable | 2026-06-08 07:25:05.599050 |
Kea crash upon interaction between specific client options and subnet selection
HIGH (7.5)
If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort with an assertion failure. This happens only if the client request is unicast directly to Kea; broadcast messages do not cause the problem.
This issue affects Kea versions 2.7.1 through 2.7.9, 3.0.0, and 3.1.0.
Published: 2025-08-27T20:23:29.489Z
Updated: 2025-11-04T21:10:15.428Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32803 |
vulnerable | 2026-06-08 07:19:00.869887 |
Insecure file permissions can result in confidential information leakage
MEDIUM (4)
In some cases, Kea log files or lease files may be world-readable.
This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Published: 2025-05-28T17:08:20.769Z
Updated: 2025-05-28T17:28:58.513Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32802 |
vulnerable | 2026-06-08 07:19:00.869622 |
Insecure handling of file paths allows multiple local attacks
MEDIUM (6.1)
Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.
This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Published: 2025-05-28T17:08:11.180Z
Updated: 2025-05-28T17:23:22.213Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32801 |
vulnerable | 2026-06-08 07:19:00.869254 |
Loading a malicious hook library can lead to local privilege escalation
HIGH (7.8)
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.
This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Published: 2025-05-28T17:03:34.499Z
Updated: 2025-05-28T17:33:50.355Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11232 |
vulnerable | 2026-06-08 07:02:28.454776 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-6474 |
vulnerable | 2026-06-08 05:14:11.669728 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-6473 |
vulnerable | 2026-06-08 05:14:11.666616 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-6472 |
vulnerable | 2026-06-08 05:14:11.664581 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.