kea-3.0.2

[Joe Locash]

Fixes CVE-2025-11232: Invalid characters cause assert

Rated high.

​https://kb.isc.org/docs/cve-2025-11232

[Douglas R. Reno]

# Kea 3.0.2 Vulnerability Release Notes, October 29, 2025

Welcome to Kea 3.0.2, a vulnerability release of the stable 3.0 series.
This supersedes the previous release, version 3.0.1.

Kea is a DHCP implementation developed by Internet Systems Consortium
(ISC) that features DHCPv4 and DHCPv6 servers with DNS update and a REST
API; optional database support (MySQL and PostgreSQL); optional RADIUS,
Kerberos, YANG/NETCONF, and GSS-TSIG support; and much more. Kea
provides extensive management capabilities, including but not limited
to: TLS support, Role-Based Access Control, run-time configuration
monitoring and updates via a REST API, host reservations, and client
classification.

The text below references issue numbers. For more details, visit the Kea
GitLab page at https://gitlab.isc.org/isc-projects/kea/-/issues. For
details about Docker issues, visit the page at
https://gitlab.isc.org/isc-projects/kea-docker/-/issues/. For details
about packaging, visit the page at
https://gitlab.isc.org/isc-projects/kea-packaging/-/issues/.

The following changes and fixes have been introduced in version 3.0.2:

1. **Vulnerability**: Corrected an issue, where specific DDNS
configuration parameters result in kea-dhcp4 exiting unexpectedly when a
client sends certain option content [#4142, #4155].

2. **Ping-check**: A debug log message is now printed instead of a
misleading error message when lease threshold is used along with
ping-check [#4129, #4182]. Corrected a deadlock potential situation in
ping-check [#4140, #4177]. Fixed a data race in ping-check [#4164,
#4178].

## Incompatible Changes

There are no incompatible changes.

## Known Issues

There are no significant known issues.

## Changes

The following summarizes changes and important upgrades introduced in
version 3.0.2:

2384.	[sec]		tmark
	When a hostname or FQDN received from a client is
	reduced to an empty string by hostname sanitizing,
	kea-dhcp4 and kea-dhcp6 will now drop the option.
	CVE:2025-11232
	(Gitlab #4142, #4155)

2383.	[build]		razvan
	The library version numbers have been bumped up for the Kea 3.0.2
	stable release.
	(Gitlab #4173)

2382.	[bug]		razvan
	Removed logging an error in ping check hook library if
	using lease cache treshold.
	(Gitlab #4129, #4182)

2381.	[bug]		razvan, liyunqing_kylin
	Fixed deadlock in ping-check hooks library. Thanks to
	liyunqing_kylin for reporting and providing a patch.
	(Gitlab #4140, #4177)

2380.	[bug]		razvan, liyunqing_kylin
	Fixed a data race in ping-check hooks library. Thanks to
	liyunqing_kylin for reporting and testing the fix for this
	issue.
	(Gitlab #4164, #4178)

[Douglas R. Reno]

This update is... a bit complicated.

I've updated the book to 3.0.2 at a081f171b1a5aa3ffb8f291533e43d99e1696db7

I had to update the systemd units because they had several bugs including removing /run/kea anytime one of the four services stopped.

After getting that going though, I decided to take a look at the SysV version... and have discovered that the bootscripts can't work in their current state. One of the problems is ordering since we are using dhcp_ddns by default, and that requires named. There is also support for postgresql and mariadb, and Kea gets started before those are up. Kea is also brought up in rc1, where there is no network.

In addition, the bootscript for Kea runs /usr/sbin/keactrl - which references /etc/kea/keactrl, and uses /usr/etc for reading configuration files.

I am starting up a build of SysV with jhalfs right now on the same VM I did this for systemd on, but am going to go work on other tickets while that is building.

I do not feel comfortable filing a security advisory for this until the bootscripts are fixed, so this ticket probably won't be closed for another day or two.

[Douglas R. Reno]

SA-12.4-061 issued.

Fixed the problems with Kea on SysV at ea498a7c990fafe8a0000541101184928ed64987 and fixed building it with Boost 1.90.0 at 76460ef10a3a2e9c1ee234c98111fbe8204c6172

[Bruce Dubbs]

Milestone renamed