Malicious Hook Library Vulnerability in ISC Kea: CVE-2025-32801
Summary
CVE-2025-32801: Kea configuration and API directives can be used to load a malicious hook library. Affects kea versions < 2.6.3-r0. Fixed in 2.6.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ISC Kea is a widely used open-source DHCP server that provides dynamic IP address allocation and management for networks. It is designed for high performance and flexibility, allowing users to configure various aspects of DHCP services. However, certain configurations can inadvertently expose the system to security risks, particularly when running as root and leaving API entry points unsecured.
Vulnerability Detail
The vulnerability identified as CVE-2025-32801 allows attackers to load a malicious hook library through Kea's configuration and API directives. This issue arises from common practices where Kea is run with root privileges, API entry points are left unsecured by default, and control sockets are placed in insecure paths. The ramifications of this vulnerability include unauthorized access to the system, potential data breaches, and the ability to execute arbitrary code, leading to severe security incidents.
How To Fix
Minimum fixed version
2.6.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade keaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the API entry points and ensure that control sockets are placed in secure paths. Additionally, running Kea with non-root privileges can mitigate some risks associated with this vulnerability.
Conclusion
CVE-2025-32801 presents a significant security risk for users of ISC Kea due to its potential for allowing unauthorized access through malicious hook libraries. It is crucial for users to update to the latest patched versions and implement recommended security practices to mitigate this vulnerability.
See every vulnerability recorded for kea →
FAQ
CVE-2025-32801 is a vulnerability in ISC Kea that allows attackers to load malicious hook libraries due to insecure configurations.
The affected versions include Kea 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2025-32801 is 7.8, indicating a high severity level.
If immediate updates are not possible, implement workarounds such as securing API entry points and running Kea with non-root privileges.
Related vulnerabilities
Recent vulnerabilities recorded for kea.
