Every CVE Search/ Get API key

CVE-2019-6472

A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate

6.5 MediumFix available

CVE-2019-6472 is a medium vulnerability (CVSS 6.5) in Isc Kea, published August 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in kea 1.7.2-r0.

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.80%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.5

A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Record
CVE-2019-6472
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
EUVDEUVD-2019-16032 6.5

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Record
EUVD-2019-16032
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-fq2x-j295-rq5g 6.5

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit...

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Record
GHSA-fq2x-j295-rq5g
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
NVD 6.5

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Record
CVE-2019-6472
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
3.3 LowAV:A/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-617
Updated
2026-11-02
OSVALPINE-CVE-2019-6472 6.5

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Record
ALPINE-CVE-2019-6472
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 6.5

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Record
CVE-2019-6472
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-6472 6.5

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Record
DEBIAN-CVE-2019-6472
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-6472 6.5

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.

Record
UBUNTU-CVE-2019-6472
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kea
Alpine:v3.11
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.12
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.13
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.14
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.15
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.16
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.17
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.18
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.19
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.20
 1.4.0 up to 1.7.2-r0
1.7.2-r0
Show 9 moreShow less
Affected packages
PackageAffectedFixed
kea
Alpine:v3.21
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.22
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.23
 1.4.0 up to 1.7.2-r0
1.7.2-r0
kea
Alpine:v3.24
 1.4.0 up to 1.7.2-r0
1.7.2-r0
isc-kea
Debian:12
 before 1.7.5-1
1.7.5-1
isc-kea
Debian:13
 before 1.7.5-1
1.7.5-1
isc-kea
Debian:14
 before 1.7.5-1
1.7.5-1
isc-kea
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.0.0-11.0.0-1build11.0.0-1ubuntu0.1~esm1
 None known
isc-kea
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.0-11.1.0-1build11.1.0-1build21.1.0-1ubuntu0.1~esm1
 None known

History

History
WhenChangedSources
2026-11-03affectedOSV
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open