Critical Denial of Service Vulnerability in Kea DHCP Package
Summary
RLSA-2026:7342: Important: kea security update. Affects kea versions < 0:3.0.1-3.el10_1. Fixed in 0:3.0.1-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Kea is a robust DHCP implementation developed by the Internet Systems Consortium, Inc., featuring fully functional DHCPv4 and DHCPv6 servers, as well as Dynamic DNS capabilities. It supports essential functionalities such as server discovery, address assignment, renewal, rebinding, and release. The DHCPv6 server additionally supports prefix delegation, while both servers utilize a DNS Update mechanism through a stand-alone DDNS daemon. This makes Kea a vital component for network management, but it is susceptible to specific security vulnerabilities.
Vulnerability Detail
The vulnerability identified as CVE-2026-3608 allows for a Denial of Service (DoS) attack through the exploitation of a maliciously crafted message. This can lead to service interruptions, affecting the availability of DHCP services. The vulnerability arises from improper handling of certain messages, which can overwhelm the server and render it unresponsive. The CVSS score for this vulnerability is 7.5, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:3.0.1-3.el10_1
This is the first release that contains the fix.
sudo dnf update keaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement network-level controls to filter out potentially malicious messages targeting the DHCP server. This may involve configuring firewalls to restrict incoming traffic to known and trusted sources.
Conclusion
The Kea DHCP package has a critical vulnerability (CVE-2026-3608) that can lead to Denial of Service attacks. It is imperative for users to update to the patched version as soon as possible to safeguard their systems. Additionally, temporary workarounds can be employed to reduce risk while awaiting updates.
See every vulnerability recorded for kea →
FAQ
CVE-2026-3608 is a vulnerability in the Kea DHCP package that allows for Denial of Service attacks through maliciously crafted messages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to service interruptions, making the DHCP services unavailable to clients.
You can update the Kea package using the command 'sudo yum update kea' to ensure you have the latest patched version.
Yes, implementing network-level controls to filter out potentially malicious messages can help mitigate the risk until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for kea.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
