{"id":"CVE-2025-11232","aliases":["ALSA-2025:21038","EUVD-2025-36693","GHSA-wcxf-jmjh-x27q","RHSA-2025:21038","RLSA-2025:21038","SUSE-SU-2026:20989-1","UBUNTU-CVE-2025-11232","openSUSE-SU-2025:15677-1","openSUSE-SU-2026:20452-1"],"status":"published","title":"Invalid characters cause assert","description":"To trigger the issue, three configuration parameters must have specific settings: \"hostname-char-set\" must be left at the default setting, which is \"[^A-Za-z0-9.-]\"; \"hostname-char-replacement\" must be empty (the default); and \"ddns-qualifying-suffix\" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly.\nThis issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00421,"percentile":0.36693,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-823"],"published":"2025-10-29T00:00:00Z","modified":"2026-10-29T11:30:04Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"kea-doc","fixed_in":["3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-debuginfo","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-debugsource","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-devel-debuginfo","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-doc","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-hooks","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-hooks-debuginfo","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-keama-debuginfo","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-libs-debuginfo","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-libs","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-keama","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"kea","fixed_in":["0:3.0.1-2.el10_1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"kea","fixed_in":["3.0.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"kea-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-hooks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-hooks-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-keama-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"kea-keama","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"kea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el10_1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"isc","product":"kea"}],"references":[{"url":"https://kb.isc.org/docs/cve-2025-11232","tags":["vendor-advisory","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/29/5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11232","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wcxf-jmjh-x27q"},{"url":"https://access.redhat.com/errata/RHSA-2025:21038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11232","tags":["report"]},{"url":"https://bugzilla.redhat.com/2407178","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-21038.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407178","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21038.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11232","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2025:21038","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620989-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1252863","tags":["report"]},{"url":"https://bugzilla.suse.com/1260380","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3608","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-11232","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-11232","title":"Invalid characters cause assert","description":"To trigger the issue, three configuration parameters must have specific settings: \"hostname-char-set\" must be left at the default setting, which is \"[^A-Za-z0-9.-]\"; \"hostname-char-replacement\" must be empty (the default); and \"ddns-qualifying-suffix\" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly.\nThis issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.","status":"published","published":"2025-10-29T18:02:39.421Z","modified":"2025-11-04T21:09:09.184Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-823"],"updated_at":"2026-11-02T14:32:50.872559Z"}],"euvd":[{"id":"EUVD-2025-36693","description":"To trigger the issue, three configuration parameters must have specific settings: \"hostname-char-set\" must be left at the default setting, which is \"[^A-Za-z0-9.-]\"; \"hostname-char-replacement\" must be empty (the default); and \"ddns-qualifying-suffix\" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly.\nThis issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.","status":"published","published":"2025-10-29T18:02:39Z","modified":"2025-11-04T21:09:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:21.645169Z"}],"ghsa":[{"id":"GHSA-wcxf-jmjh-x27q","title":"To trigger the issue, three configuration parameters must have specific settings: \"hostname-char...","description":"To trigger the issue, three configuration parameters must have specific settings: \"hostname-char-set\" must be left at the default setting, which is \"[^A-Za-z0-9.-]\"; \"hostname-char-replacement\" must be empty (the default); and \"ddns-qualifying-suffix\" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly.\nThis issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.","status":"published","published":"2025-10-29T18:30:35Z","modified":"2025-11-05T00:31:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-823"],"updated_at":"2026-11-02T15:04:39.50413Z"}],"nvd":[{"id":"CVE-2025-11232","description":"To trigger the issue, three configuration parameters must have specific settings: \"hostname-char-set\" must be left at the default setting, which is \"[^A-Za-z0-9.-]\"; \"hostname-char-replacement\" must be empty (the default); and \"ddns-qualifying-suffix\" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly.\nThis issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.","status":"published","published":"2025-10-29T18:15:40.197Z","modified":"2026-10-08T11:10:00.25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-823"],"updated_at":"2026-11-02T14:11:41.607433Z"}],"osv":[{"id":"RHSA-2025:21038","title":"Red Hat Security Advisory: kea security update","status":"published","published":"2025-11-12T10:28:33Z","modified":"2026-07-12T10:05:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RLSA-2025:21038","title":"Important: kea security update","description":"DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon.\n\nSecurity Fix(es):\n\n* kea: Invalid characters cause assert (CVE-2025-11232)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-11-21T18:19:15.687303Z","modified":"2025-11-21T18:48:57.764843Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2025-11232","description":"To trigger the issue, three configuration parameters must have specific settings: \"hostname-char-set\" must be left at the default setting, which is \"[^A-Za-z0-9.-]\"; \"hostname-char-replacement\" must be empty (the default); and \"ddns-qualifying-suffix\" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.","status":"withdrawn","published":"2025-10-29T18:15:00Z","modified":"2025-11-28T07:56:31.738391Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ALSA-2025:21038","title":"Important: kea security update","description":"DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon.  \n\nSecurity Fix(es):  \n\n  * kea: Invalid characters cause assert (CVE-2025-11232)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-11-11T00:00:00Z","modified":"2026-10-29T11:30:04.063897522Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"openSUSE-SU-2025:15677-1","title":"kea-3.0.2-1.1 on GA media","description":"These are all security issues fixed in the kea-3.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-29T00:00:00Z","modified":"2026-03-23T04:54:05.25839Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20452-1","title":"Security update for kea","description":"This update for kea fixes the following issues:\n\nUpdate to 3.0.3:\n\n- CVE-2025-11232: invalid characters cause assert (bsc#1252863).\n- CVE-2026-3608: stack overflow via maliciously crafted message (bsc#1260380).\n\nChangelog:\n\n * A large number of bracket pairs in a JSON payload directed to\n any endpoint would result in a stack overflow, due to recursive\n calls when parsing the JSON. This has been fixed.\n (CVE-2026-3608)\n [bsc#1260380]\n * When a hostname or FQDN received from a client is reduced to an\n empty string by hostname sanitizing, kea-dhcp4 and kea-dhcp6\n will now drop the option.\n (CVE-2025-11232)\n [bsc#1252863]\n * A null dereference is now no longer possible when configuring\n the Control Agent with a socket that lacks the mandatory\n socket-name entry.\n * UNIX sockets are now created as group-writable.\n * Removed logging an error in ping check hook library if using\n lease cache treshold.\n * Fixed deadlock in ping-check hooks library.\n * Fixed a data race in ping-check hooks library.\n","status":"published","published":"2026-04-01T09:24:21Z","modified":"2026-04-03T07:45:57.303504Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:20989-1","title":"Security update for kea","description":"This update for kea fixes the following issues:\n\nUpdate to 3.0.3:\n\n- CVE-2025-11232: invalid characters cause assert (bsc#1252863).\n- CVE-2026-3608: stack overflow via maliciously crafted message (bsc#1260380).\n\nChangelog:\n\n * A large number of bracket pairs in a JSON payload directed to\n any endpoint would result in a stack overflow, due to recursive\n calls when parsing the JSON. This has been fixed.\n (CVE-2026-3608)\n [bsc#1260380]\n * When a hostname or FQDN received from a client is reduced to an\n empty string by hostname sanitizing, kea-dhcp4 and kea-dhcp6\n will now drop the option.\n (CVE-2025-11232)\n [bsc#1252863]\n * A null dereference is now no longer possible when configuring\n the Control Agent with a socket that lacks the mandatory\n socket-name entry.\n * UNIX sockets are now created as group-writable.\n * Removed logging an error in ping check hook library if using\n lease cache treshold.\n * Fixed deadlock in ping-check hooks library.\n * Fixed a data race in ping-check hooks library.\n","status":"published","published":"2026-04-01T09:22:53Z","modified":"2026-04-10T18:24:39.745551Z","updated_at":"2026-11-02T15:54:01.953589Z"}]}}