Summary
Ali Norouzi discovered that Kea DHCP did not properly handle maliciously
crafted messages over configured API sockets and HA listeners. A remote
attacker could possibly use this issue to cause Kea DHCP to crash,
resulting in a denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | isc-kea | 2.4.1-3ubuntu0.2 |
| Ubuntu · 25.10 | isc-kea | 2.6.3-2ubuntu0.1 |
References
-
report
https://ubuntu.com/security/CVE-2026-3608