Bug 2391373 (CVE-2025-40779) - CVE-2025-40779 kea: Kea crash upon interaction between specific client options and subnet selection
Summary: CVE-2025-40779 kea: Kea crash upon interaction between specific client option...
Keywords:
Status: NEW
Alias: CVE-2025-40779
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2392383
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-08-27 21:01 UTC by OSIDB Bzimport
Modified: 2025-11-11 19:12 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:21006 0 None None None 2025-11-11 19:12:25 UTC

Description OSIDB Bzimport 2025-08-27 21:01:21 UTC 
If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort with an assertion failure.  This happens only if the client request is unicast directly to Kea; broadcast messages do not cause the problem.
This issue affects Kea versions 2.7.1 through 2.7.9, 3.0.0, and 3.1.0.
Comment 2 errata-xmlrpc 2025-11-11 19:12:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:21006 https://access.redhat.com/errata/RHSA-2025:21006
Note You need to log in before you can comment on or make changes to this bug.