CVE-2025-32801
Loading a malicious hook library can lead to local privilege escalation
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Loading a malicious hook library can lead to local privilege escalation
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
- Record
CVE-2025-32801- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2025-16210
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
- Record
EUVD-2025-16210- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hv8v-455m-2grc
Kea configuration and API directives can be used to load a malicious hook library. Many common...
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
- Record
GHSA-hv8v-455m-2grc- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
- Record
CVE-2025-32801- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-32801
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
- Record
ALPINE-CVE-2025-32801- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
- Record
CVE-2025-32801- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2025-32801
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
- Record
DEBIAN-CVE-2025-32801- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:9178
Red Hat Security Advisory: kea security update
- Record
RHSA-2025:9178- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2025:9178
Important: kea security update
DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon.
Security Fix(es):
-
kea: Loading a malicious hook library can lead to local privilege escalation (CVE-2025-32801)
-
kea: Insecure handling of file paths allows multiple local attacks (CVE-2025-32802)
-
kea: Insecure file permissions can result in confidential information leakage (CVE-2025-32803)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:9178- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-32801
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
- Record
UBUNTU-CVE-2025-32801- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2025:9178 No score
Important: kea security update
DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon.
Security Fix(es):
- kea: Loading a malicious hook library can lead to local privilege escalation (CVE-2025-32801)
- kea: Insecure handling of file paths allows multiple local attacks (CVE-2025-32802)
- kea: Insecure file permissions can result in confidential information leakage (CVE-2025-32803)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:9178- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15181-1 No score
kea-2.6.3-1.1 on GA media
These are all security issues fixed in the kea-2.6.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15181-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0907-1 No score
Security update for kea
This update for kea fixes the following issues:
Update to release 2.6.3 (bsc#1243240):
- CVE-2025-32801: Loading a malicious hook library can lead to local privilege escalation.
- CVE-2025-32802: Insecure handling of file paths allows multiple local attacks.
- CVE-2025-32803: Insecure file permissions can result in confidential information leakage.
- Record
SUSE-SU-2026:0907-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1091-1 No score
Security update for kea
This update for kea fixes the following issues:
Update to release 2.6.3 (bsc#1243240):
- CVE-2025-32801: Fixed loading a malicious hook library can lead to local privilege escalation.
- CVE-2025-32802: Fixed insecure handling of file paths allows multiple local attacks.
- CVE-2025-32803: Fixed insecure file permissions can result in confidential information leakage.
- Record
SUSE-SU-2026:1091-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keaAlpine:v3.22 |
before 2.6.3-r0 | 2.6.3-r0 |
keaAlpine:v3.23 |
before 2.6.3-r0 | 2.6.3-r0 |
keaAlpine:v3.24 |
before 2.6.3-r0 | 2.6.3-r0 |
kea-docAlmaLinux:10 From an advisory covering 3 CVEs |
before 2.6.3-1.el10_0 | 2.6.3-1.el10_0 |
isc-keaDebian:12 |
All versions, plus listed versions 2.2.0-62.2.0-72.2.0-82.2.1-12.2.1-2 Show 19 moreShow less2.2.1-32.4.0-12.4.1-12.4.1-22.4.1-32.6.1-12.6.1-22.6.3-12.6.3-22.6.4-13.0.2-13.0.2-23.0.2-33.0.3-13.0.3-1~bpo13+13.0.3-23.0.3-33.0.4-13.0.4-2 |
None known |
isc-keaDebian:13 |
before 2.6.3-1 | 2.6.3-1 |
isc-keaDebian:14 |
before 2.6.3-1 | 2.6.3-1 |
kea-debuginfoRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
kea-debugsourceRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
kea-docRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kea-hooksRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
kea-hooks-debuginfoRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
kea-keama-debuginfoRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
kea-libs-debuginfoRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
keaRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
kea-libsRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
kea-keamaRed Hat:enterprise_linux:10.0 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
keaRocky Linux:10 From an advisory covering 3 CVEs |
before 0:2.6.3-1.el10_0 | 0:2.6.3-1.el10_0 |
keaSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs |
before 2.6.3-150700.3.3.5 | 2.6.3-150700.3.3.5 |
keaSUSE:Linux Enterprise Module for Server Applications 15 SP7 From an advisory covering 3 CVEs |
before 2.6.3-150700.3.3.5 | 2.6.3-150700.3.3.5 |
keaSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 3 CVEs |
before 2.6.3-150600.13.6.1 | 2.6.3-150600.13.6.1 |
keaSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 3 CVEs |
before 2.6.3-150600.13.6.1 | 2.6.3-150600.13.6.1 |
keaopenSUSE:Leap 15.6 From an advisory covering 3 CVEs |
before 2.6.3-150600.13.6.1 | 2.6.3-150600.13.6.1 |
isc-keaUbuntu:24.04:LTS |
All versions, plus listed versions 2.2.1-32.4.0-12.4.1-12.4.1-2build12.4.1-3build1 Show 4 moreShow less2.4.1-3build32.4.1-3build3.12.4.1-3ubuntu0.12.4.1-3ubuntu0.2 |
None known |
keaopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 2.6.3-1.1 | 2.6.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-32801 is a high vulnerability (CVSS 7.8) in Isc Kea, published May 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in kea 2.6.3-r0.
References
kb.isc.org/docs/cve-2025-32801
nvd.nist.gov/vuln/detail/CVE-2025-32801
github.com/advisories/GHSA-hv8v-455m-2grc
security.alpinelinux.org/vuln/CVE-2025-32801
access.redhat.com/errata/RHSA-2025:9178
Show 29 moreShow less
bugzilla.redhat.com/2366362
errata.almalinux.org/10/ALSA-2025-9178.html
security-tracker.debian.org/tracker/CVE-2025-32801
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9178.json
cve.org/CVERecord?id=CVE-2025-32801
errata.rockylinux.org/RLSA-2025:9178
suse.com/support/update/announcement/2026/suse-su-20260907-1
bugzilla.suse.com/1243240
ubuntu.com/security/CVE-2025-32801
openwall.com/lists/oss-security/2025/05/28/7
lists.opensuse.org/archives/list/[email protected]/thread/ARL5ORNLSGS5LRWXQNSRNYLZHEI24B4N