Kea DHCP Vulnerability - High-Severity Flaw Causes Crashes

The Flaw

The Internet Systems Consortium (ISC) has issued a serious warning regarding a high-severity vulnerability in the Kea DHCP server, tracked as CVE-2026-3608. This flaw allows unauthenticated remote attackers to exploit a stack overflow error, leading to a complete crash of the DHCP services. When successfully exploited, the receiving daemon fails, causing a sudden and total loss of DHCP functionality across the network.

The vulnerability arises from how Kea daemons process incoming messages over specific listening channels. An attacker can trigger this flaw by sending a specially crafted message through any configured API socket or High Availability (HA) listener. This improper handling of incoming payloads results in a stack overflow, forcing the service to terminate unexpectedly. The affected components include the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, and kea-dhcp6 daemons.

What's at Risk

With a CVSS v3.1 score of 7.5, this vulnerability poses a significant threat to network stability. It requires no user interaction and no elevated privileges, meaning any attacker with network access to the API sockets can exploit it. The primary consequence is a denial-of-service condition, disrupting IP address assignments and breaking network connectivity for new devices. This can severely impact enterprise operations, leading to potential downtime and loss of productivity.

Fortunately, the ISC has reported that they are currently unaware of any active exploits in the wild. However, the potential for disruption is high, making it crucial for organizations to address this vulnerability promptly.

Patch Status

To mitigate this vulnerability, the ISC strongly recommends that organizations immediately upgrade their Kea deployments to the latest patched versions. Administrators running the 2.6 branch should update to Kea 2.6.5, while those on the 3.0 branch must upgrade to Kea 3.0.3. These updates are essential to secure environments against possible denial-of-service attacks.

For those unable to patch their systems right away, the ISC has provided a temporary workaround. Organizations can block the exploitation path by securing their API sockets with Transport Layer Security (TLS) and enforcing strict mutual authentication. By requiring a valid client certificate, administrators can prevent attackers from establishing the necessary API connection to deliver the malicious payload.

Immediate Actions

Network administrators must prioritize addressing this vulnerability to maintain service continuity. Here are the immediate actions to take:

• Upgrade to the latest versions of Kea DHCP as soon as possible.
• Implement TLS to secure API sockets and enforce mutual authentication.
• Monitor network traffic for any unusual activity that may indicate attempts to exploit this vulnerability.

By taking these steps, organizations can protect their networks from potential disruptions and ensure the stability of their DHCP services.