Critical Denial of Service Vulnerability in Kea DHCP Package
Summary
ALSA-2026:7342: Important: kea security update. Affects kea versions < 3.0.1-3.el10_1. Fixed in 3.0.1-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kea is a DHCP implementation developed by the Internet Systems Consortium, Inc., providing fully functional DHCPv4, DHCPv6, and Dynamic DNS servers. It supports essential features such as server discovery, address assignment, renewal, rebinding, and release. The DHCPv6 server additionally supports prefix delegation and both servers utilize a DNS Update mechanism through a stand-alone DDNS daemon.
Vulnerability Detail
The vulnerability identified as CVE-2026-3608 allows for a Denial of Service (DoS) attack through the sending of maliciously crafted messages to the Kea DHCP servers. This could lead to service interruptions, affecting the availability of network services that rely on DHCP for IP address management. The flaw arises from improper handling of specific message types, which can overwhelm the server and render it unresponsive.
How To Fix
Minimum fixed version
3.0.1-3.el10_1
This is the first release that contains the fix.
sudo dnf update keaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the exposure of your DHCP servers to untrusted networks or implement firewall rules to restrict access to the DHCP service until the patch is applied.
Conclusion
The Kea DHCP package has a critical vulnerability (CVE-2026-3608) that can lead to Denial of Service attacks. It is essential to update to the patched version 3.0.1-3.el10_1 to mitigate this risk. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for kea →
FAQ
CVE-2026-3608 is a vulnerability in the Kea DHCP package that allows for Denial of Service attacks via maliciously crafted messages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to service interruptions, making the DHCP server unresponsive and affecting network services that depend on it.
Yes, a patch is available in version 3.0.1-3.el10_1 of the Kea package. It is recommended to update to this version.
If you cannot apply the patch immediately, consider implementing firewall rules to limit access to the DHCP service as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for kea.
