Every CVE Search/ Get API key

CVE-2025-32803

Insecure file permissions can result in confidential information leakage

4.0 MediumFix available

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.24%Up 0.2 points since May 29, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.0

Insecure file permissions can result in confidential information leakage

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Record
CVE-2025-32803
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-276
Updated
2026-11-02
EUVDEUVD-2025-16200 4.0

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Record
EUVD-2025-16200
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-prj7-2jhj-62fj 4.0

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea...

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Record
GHSA-prj7-2jhj-62fj
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-276
Updated
2026-11-02
NVD 4.0

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Record
CVE-2025-32803
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-276
Updated
2026-11-02
OSVALPINE-CVE-2025-32803 4.0

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Record
ALPINE-CVE-2025-32803
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSV 4.0

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Record
CVE-2025-32803
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2025-32803 4.0

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Record
DEBIAN-CVE-2025-32803
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2025:9178 7.8

Red Hat Security Advisory: kea security update

Record
RHSA-2025:9178
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:9178 7.8

Important: kea security update

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon.

Security Fix(es):

  • kea: Loading a malicious hook library can lead to local privilege escalation (CVE-2025-32801)

  • kea: Insecure handling of file paths allows multiple local attacks (CVE-2025-32802)

  • kea: Insecure file permissions can result in confidential information leakage (CVE-2025-32803)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:9178
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-32803 4.0

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Record
UBUNTU-CVE-2025-32803
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVALSA-2025:9178 No score

Important: kea security update

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon.

Security Fix(es):

  • kea: Loading a malicious hook library can lead to local privilege escalation (CVE-2025-32801)
  • kea: Insecure handling of file paths allows multiple local attacks (CVE-2025-32802)
  • kea: Insecure file permissions can result in confidential information leakage (CVE-2025-32803)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:9178
Updated
2026-11-02
OSVopenSUSE-SU-2025:15181-1 No score

kea-2.6.3-1.1 on GA media

These are all security issues fixed in the kea-2.6.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15181-1
Updated
2026-11-02
OSVSUSE-SU-2026:0907-1 No score

Security update for kea

This update for kea fixes the following issues:

Update to release 2.6.3 (bsc#1243240):

  • CVE-2025-32801: Loading a malicious hook library can lead to local privilege escalation.
  • CVE-2025-32802: Insecure handling of file paths allows multiple local attacks.
  • CVE-2025-32803: Insecure file permissions can result in confidential information leakage.
Record
SUSE-SU-2026:0907-1
Updated
2026-11-02
OSVSUSE-SU-2026:1091-1 No score

Security update for kea

This update for kea fixes the following issues:

Update to release 2.6.3 (bsc#1243240):

  • CVE-2025-32801: Fixed loading a malicious hook library can lead to local privilege escalation.
  • CVE-2025-32802: Fixed insecure handling of file paths allows multiple local attacks.
  • CVE-2025-32803: Fixed insecure file permissions can result in confidential information leakage.
Record
SUSE-SU-2026:1091-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kea
Alpine:v3.22
 before 2.6.3-r0
2.6.3-r0
kea
Alpine:v3.23
 before 2.6.3-r0
2.6.3-r0
kea
Alpine:v3.24
 before 2.6.3-r0
2.6.3-r0
kea-doc
AlmaLinux:10
From an advisory covering 3 CVEs
 before 2.6.3-1.el10_0
2.6.3-1.el10_0
isc-kea
Debian:12
 All versions, plus listed versions
2.2.0-62.2.0-72.2.0-82.2.1-12.2.1-2
Show 19 moreShow less
2.2.1-32.4.0-12.4.1-12.4.1-22.4.1-32.6.1-12.6.1-22.6.3-12.6.3-22.6.4-13.0.2-13.0.2-23.0.2-33.0.3-13.0.3-1~bpo13+13.0.3-23.0.3-33.0.4-13.0.4-2
 None known
isc-kea
Debian:13
 before 2.6.3-1
2.6.3-1
isc-kea
Debian:14
 before 2.6.3-1
2.6.3-1
kea-debuginfo
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea-debugsource
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea-doc
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
Show 16 moreShow less
Affected packages
PackageAffectedFixed
kea-hooks
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea-hooks-debuginfo
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea-keama-debuginfo
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea-libs-debuginfo
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea-libs
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea-keama
Red Hat:enterprise_linux:10.0
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea
Rocky Linux:10
From an advisory covering 3 CVEs
 before 0:2.6.3-1.el10_0
0:2.6.3-1.el10_0
kea
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 2.6.3-150700.3.3.5
2.6.3-150700.3.3.5
kea
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 3 CVEs
 before 2.6.3-150700.3.3.5
2.6.3-150700.3.3.5
kea
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 3 CVEs
 before 2.6.3-150600.13.6.1
2.6.3-150600.13.6.1
kea
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 3 CVEs
 before 2.6.3-150600.13.6.1
2.6.3-150600.13.6.1
kea
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 2.6.3-150600.13.6.1
2.6.3-150600.13.6.1
isc-kea
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.2.1-32.4.0-12.4.1-12.4.1-2build12.4.1-3build1
Show 4 moreShow less
2.4.1-3build32.4.1-3build3.12.4.1-3ubuntu0.12.4.1-3ubuntu0.2
 None known
isc-kea
Ubuntu:25.10
 before 2.6.3-1, plus listed versions
2.6.1-12.6.1-2
2.6.3-1
kea
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 2.6.3-1.1
2.6.3-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-32803 is a medium vulnerability (CVSS 4.0) in Isc Kea, published May 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in kea 2.6.3-r0.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open