Every CVE Search/ Get API key

CVE-2025-11232

Invalid characters cause assert

7.5 HighFix available

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must NOT be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.42%Up 0.4 points since Oct 30, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Invalid characters cause assert

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must NOT be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

Record
CVE-2025-11232
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-823
Updated
2026-11-02
EUVDEUVD-2025-36693 7.5

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must NOT be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

Record
EUVD-2025-36693
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-wcxf-jmjh-x27q 7.5

To trigger the issue, three configuration parameters must have specific settings: "hostname-char...

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must NOT be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

Record
GHSA-wcxf-jmjh-x27q
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-823
Updated
2026-11-02
NVD 7.5

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must NOT be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

Record
CVE-2025-11232
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-823
Updated
2026-11-02
OSVRHSA-2025:21038 7.5

Red Hat Security Advisory: kea security update

Record
RHSA-2025:21038
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:21038 7.5

Important: kea security update

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon.

Security Fix(es):

  • kea: Invalid characters cause assert (CVE-2025-11232)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:21038
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2025-11232 7.5

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must NOT be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

Record
UBUNTU-CVE-2025-11232
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2025:21038 No score

Important: kea security update

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon.

Security Fix(es):

  • kea: Invalid characters cause assert (CVE-2025-11232)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:21038
Updated
2026-11-02
OSVopenSUSE-SU-2025:15677-1 No score

kea-3.0.2-1.1 on GA media

These are all security issues fixed in the kea-3.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15677-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20452-1 No score

Security update for kea

This update for kea fixes the following issues:

Update to 3.0.3:

  • CVE-2025-11232: invalid characters cause assert (bsc#1252863).
  • CVE-2026-3608: stack overflow via maliciously crafted message (bsc#1260380).

Changelog:

  • A large number of bracket pairs in a JSON payload directed to any endpoint would result in a stack overflow, due to recursive calls when parsing the JSON. This has been fixed. (CVE-2026-3608) [bsc#1260380]
  • When a hostname or FQDN received from a client is reduced to an empty string by hostname sanitizing, kea-dhcp4 and kea-dhcp6 will now drop the option. (CVE-2025-11232) [bsc#1252863]
  • A null dereference is now no longer possible when configuring the Control Agent with a socket that lacks the mandatory socket-name entry.
  • UNIX sockets are now created as group-writable.
  • Removed logging an error in ping check hook library if using lease cache treshold.
  • Fixed deadlock in ping-check hooks library.
  • Fixed a data race in ping-check hooks library.
Record
openSUSE-SU-2026:20452-1
Updated
2026-11-02
OSVSUSE-SU-2026:20989-1 No score

Security update for kea

This update for kea fixes the following issues:

Update to 3.0.3:

  • CVE-2025-11232: invalid characters cause assert (bsc#1252863).
  • CVE-2026-3608: stack overflow via maliciously crafted message (bsc#1260380).

Changelog:

  • A large number of bracket pairs in a JSON payload directed to any endpoint would result in a stack overflow, due to recursive calls when parsing the JSON. This has been fixed. (CVE-2026-3608) [bsc#1260380]
  • When a hostname or FQDN received from a client is reduced to an empty string by hostname sanitizing, kea-dhcp4 and kea-dhcp6 will now drop the option. (CVE-2025-11232) [bsc#1252863]
  • A null dereference is now no longer possible when configuring the Control Agent with a socket that lacks the mandatory socket-name entry.
  • UNIX sockets are now created as group-writable.
  • Removed logging an error in ping check hook library if using lease cache treshold.
  • Fixed deadlock in ping-check hooks library.
  • Fixed a data race in ping-check hooks library.
Record
SUSE-SU-2026:20989-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kea-doc
AlmaLinux:10
 before 3.0.1-2.el10_1
3.0.1-2.el10_1
kea-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea-debugsource
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea-devel-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea-doc
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea-hooks
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea-hooks-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea-keama-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea-libs-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
kea-libs
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea-keama
Red Hat:enterprise_linux:10.1
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea
Rocky Linux:10
 before 0:3.0.1-2.el10_1
0:3.0.1-2.el10_1
kea
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 3.0.3-160000.1.1
3.0.3-160000.1.1
kea
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 3.0.3-160000.1.1
3.0.3-160000.1.1
kea
openSUSE:Tumbleweed
 before 3.0.2-1.1
3.0.2-1.1
kea
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 3.0.3-160000.1.1
3.0.3-160000.1.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-11232 is a high vulnerability (CVSS 7.5) in Isc Kea, published October 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in kea-doc 3.0.1-2.el10_1.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open