CVE-2019-6473
A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate
CVE-2019-6473 is a medium vulnerability (CVSS 6.5) in Ics Kea, published August 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in kea 1.7.2-r0.
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
- Record
CVE-2019-6473- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2019-16033
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
- Record
EUVD-2019-16033- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5gvx-v2fm-q3fv
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea...
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
- Record
GHSA-5gvx-v2fm-q3fv- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
NVD
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
- Record
CVE-2019-6473- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 3.3 Low
AV:A/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-617
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-6473
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
- Record
ALPINE-CVE-2019-6473- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
- Record
CVE-2019-6473- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-6473
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
- Record
DEBIAN-CVE-2019-6473- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-6473
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
- Record
UBUNTU-CVE-2019-6473- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-7759-1 No score
isc-kea vulnerabilities
It was discovered that Kea DHCP did not correctly handle invalid hostnames. A remote attacker could possibly use this issue to cause a denial of service.
- Record
USN-7759-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keaAlpine:v3.11 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.12 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.13 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.14 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.15 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.16 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.17 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.18 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.19 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.20 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
keaAlpine:v3.21 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.22 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.23 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.24 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
isc-keaDebian:12 |
before 1.7.5-1 | 1.7.5-1 |
isc-keaDebian:13 |
before 1.7.5-1 | 1.7.5-1 |
isc-keaDebian:14 |
before 1.7.5-1 | 1.7.5-1 |
isc-keaUbuntu:Pro:16.04:LTS |
before 1.0.0-1ubuntu0.1~esm1, plus listed versions 1.0.0-11.0.0-1build1 |
1.0.0-1ubuntu0.1~esm1 |
isc-keaUbuntu:Pro:18.04:LTS |
before 1.1.0-1ubuntu0.1~esm1, plus listed versions 1.1.0-11.1.0-1build11.1.0-1build2 |
1.1.0-1ubuntu0.1~esm1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
kb.isc.org/docs/cve-2019-6473
nvd.nist.gov/vuln/detail/CVE-2019-6473
github.com/advisories/GHSA-5gvx-v2fm-q3fv
security.alpinelinux.org/vuln/CVE-2019-6473
security-tracker.debian.org/tracker/CVE-2019-6473
ubuntu.com/security/CVE-2019-6473
cve.org/CVERecord?id=CVE-2019-6473