Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-40779

Kea crash upon interaction between specific client options and subnet selection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
isc

Description

If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort with an assertion failure. This happens only if the client request is unicast directly to Kea; broadcast messages do not cause the problem. This issue affects Kea versions 2.7.1 through 2.7.9, 3.0.0, and 3.1.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ISC Kea

Default version status: unaffected

  • 2.7.1 to ≤ 2.7.9affected
  • 3.0.0affected
  • 3.1.0affected
  • 2.6.0 to ≤ 2.6.4unaffected

References