CVE-2019-6474
A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
- Record
CVE-2019-6474- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2019-16034
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
- Record
EUVD-2019-16034- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qxx9-pw4x-fc72
A missing check on incoming client requests can be exploited to cause a situation where the Kea...
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
- Record
GHSA-qxx9-pw4x-fc72- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-02
NVD
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
- Record
CVE-2019-6474- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 6.1 Medium
AV:A/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-772
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-6474
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
- Record
ALPINE-CVE-2019-6474- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
- Record
CVE-2019-6474- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-6474
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
- Record
DEBIAN-CVE-2019-6474- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-6474
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
- Record
UBUNTU-CVE-2019-6474- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keaAlpine:v3.11 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.12 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.13 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.14 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.15 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.16 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.17 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.18 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.19 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.20 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
keaAlpine:v3.21 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.22 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.23 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
keaAlpine:v3.24 |
1.4.0 up to 1.7.2-r0 | 1.7.2-r0 |
isc-keaDebian:12 |
before 1.7.5-1 | 1.7.5-1 |
isc-keaDebian:13 |
before 1.7.5-1 | 1.7.5-1 |
isc-keaDebian:14 |
before 1.7.5-1 | 1.7.5-1 |
isc-keaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.0.0-11.0.0-1build11.0.0-1ubuntu0.1~esm1 |
None known |
isc-keaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.1.0-11.1.0-1build11.1.0-1build21.1.0-1ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-6474 is a medium vulnerability (CVSS 5.7) in Isc Kea, published August 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 53rd percentile. Fixed in kea 1.7.2-r0.