Ubuntu 16.04 LTS / 18.04 LTS : Kea DHCP vulnerabilities (USN-7759-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7759-1 advisory. It was discovered that Kea DHCP did not correctly handle invalid hostnames. A remote attacker could possibly use this issue to cause a denial of...

Ubuntu: Security Advisory (USN-7759-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-7759-1 isc-kea vulnerabilities

It was discovered that Kea DHCP did not correctly handle invalid hostnames. A remote attacker could possibly use this issue to cause a denial of service...

USN-7759-1: Kea DHCP vulnerabilities

It was discovered that Kea DHCP did not correctly handle invalid hostnames. A remote attacker could possibly use this issue to cause a denial of service...

[SECURITY] Fedora 43 Update: kea-3.0.1-1.fc43

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers suppor...

The vulnerability of the open-source DHCP server Kea, related to an unreliable search process, allows attackers to elevate privileges within the system.

The vulnerability of the open-source DHCP server Kea is related to the use of an insecure lookup path. Exploiting this vulnerability can allow a attacker to gain increased privileges within the system...

Fedora 43 : kea (2025-9ead6bf29b)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-9ead6bf29b advisory. - New version 3.0.1 rhbz2391289 - Fixes CVE-2025-40779 rhbz2391373 Tenable has extracted the preceding description block directly from the Fedora security...

Fedora: Security Advisory (FEDORA-2025-92b4ae7199)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 42 Update: kea-3.0.1-1.fc42

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers suppor...

Fedora 42 : kea (2025-92b4ae7199)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-92b4ae7199 advisory. - New version 3.0.1 rhbz2391289 - Fixes CVE-2025-40779 rhbz2391373 Tenable has extracted the preceding description block directly from the Fedora security...

Linux Distros Unpatched Vulnerability : CVE-2025-40779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the kea-dhcp4 process will abort with...

Linux Distros Unpatched Vulnerability : CVE-2019-6472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A packet containing a malformed DUID can cause the Kea DHCPv6 server process kea-dhcp6 to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0,...

Linux Distros Unpatched Vulnerability : CVE-2019-6474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as...

Fedora 44 : kea (2025-e79e424a48)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e79e424a48 advisory. Automatic update for kea-3.0.1-1.fc44. Changelog Fri Aug 29 2025 Martin Osvald - 3.0.1-1 - New version 3.0.1 rhbz2391289 - Fixes CVE-2025-40779 rhbz2391373...

FreeBSD : ISC KEA -- kea-dhcp4 aborts if client sends a broadcast request with particular options (f727fe60-8389-11f0-8438-001b217e4ee5)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f727fe60-8389-11f0-8438-001b217e4ee5 advisory. Internet Systems Consortium, Inc. reports: We corrected an issue in kea-dhcp4 that caused the server to...

kea-3.0.1-1.1 on GA media (moderate)

kea-3.0.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15499-1 Rating: moderate Cross-References: CVE-2025-40779 CVSS scores: CVE-2025-40779 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-40779 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

SUSE CVE-2025-40779

If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the kea-dhcp4 process will abort with an assertion failure. This happens only if the client request is unicast directly to Kea; broadcast messages do not cause the problem...

CVE-2025-40779

A vulnerability was found in Kea. When an attacker who is an existing client with an assigned IP sends a crafted unicast packet directly to the server's IP and Kea cannot find any subnets that match that client's credentials, the server crashes causing a Denial of Service via assertion/NULL-path...

OPENSUSE-SU-2025:15499-1 kea-3.0.1-1.1 on GA media

These are all security issues fixed in the kea-3.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-40779

If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the kea-dhcp4 process will abort with an assertion failure. This happens only if the client request is unicast directly to Kea; broadcast messages do not cause the problem...