Bug 2451139 (CVE-2026-3608) - CVE-2026-3608 Kea: Kea: Denial of Service via maliciously crafted message
Summary: CVE-2026-3608 Kea: Kea: Denial of Service via maliciously crafted message
Keywords:
Status: NEW
Alias: CVE-2026-3608
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2451621 2452134
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-25 09:01 UTC by OSIDB Bzimport
Modified: 2026-04-28 15:04 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:11344 0 None None None 2026-04-28 09:38:36 UTC
Red Hat Product Errata RHSA-2026:7342 0 None None None 2026-04-09 18:21:14 UTC

Description OSIDB Bzimport 2026-03-25 09:01:39 UTC 
Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error.
This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.
Comment 2 errata-xmlrpc 2026-04-09 18:21:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:7342 https://access.redhat.com/errata/RHSA-2026:7342
Comment 4 errata-xmlrpc 2026-04-28 09:38:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:11344 https://access.redhat.com/errata/RHSA-2026:11344
Note You need to log in before you can comment on or make changes to this bug.