World-Readable Log and Lease Files in ISC Kea - CVE-2025-32803
Summary
CVE-2025-32803: In some cases, Kea log files or lease files may be world-readable. Affects kea versions < 2.6.3-r0. Fixed in 2.6.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ISC Kea is a DHCP server designed for high-performance and scalability, providing dynamic IP address allocation and management. It is widely used in various network environments due to its flexibility and extensibility. However, certain versions of ISC Kea have a vulnerability that allows log files and lease files to be world-readable, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2025-32803 affects ISC Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8. In these versions, log files and lease files may be accessible to any user on the system, leading to unauthorized access to potentially sensitive data. This issue arises from improper file permissions, which can lead to data leakage and compromise the security of the DHCP server.
How To Fix
Minimum fixed version
2.6.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade keaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually change the permissions of the log and lease files to restrict access. This can be done using the command: 'chmod 600 /path/to/kea/logfile' and 'chmod 600 /path/to/kea/leasefile', replacing '/path/to/kea/' with the actual path to the files.
Conclusion
CVE-2025-32803 is a significant vulnerability in ISC Kea that can lead to unauthorized access to sensitive log and lease files. Users are advised to update to the latest patched versions to mitigate this risk. Additionally, temporary workarounds are available to restrict file access until an update can be applied.
See every vulnerability recorded for kea →
FAQ
CVE-2025-32803 is a vulnerability in ISC Kea that allows log and lease files to be world-readable, potentially exposing sensitive information.
The affected versions are 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
The main risk is unauthorized access to sensitive data contained in the log and lease files, which could lead to data leakage and compromise network security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for CVE-2025-32803 is 4.0, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for kea.
