ISC Kea CVE-2025-11232

Exploitable only when ISC Kea's kea-dhcp4 is configured so that hostname-char-set is at its default ('[^A-Za-z0-9.-]'), hostname-char-replacement is empty (default), AND ddns-qualifying-suffix is set to a non-empty value (this last is the non-default operator setting that makes the flaw reachable). DDNS updates do NOT need to be enabled. Given that configuration, a remote unauthenticated attacker who can send DHCPv4 messages to the server crashes it by supplying certain option content. The limiting factor is the non-default ddns-qualifying-suffix requirement - servers that leave it empty (the default) are not affected. Affected versions: Kea 3.0.1 and 3.1.1 through 3.1.2.

This is a genuine but conditional denial-of-service issue in ISC Kea's kea-dhcp4 server. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) correctly scopes the impact to availability only - there is no confidentiality or integrity effect despite the 'Information Disclosure' and 'Memory Corruption' tags, which are both inaccurate (the observed outcome is an unexpected process exit, i.e. a crash/DoS, not data leakage or exploitable corruption). EPSS is 0.42% (34th percentile), which is unremarkable and consistent with a DoS that requires a specific non-default configuration to be reachable. There is no CISA KEV listing and no public exploit identified at time of analysis - so this is not confirmed actively exploited. The key mitigating factor is the exposure gate: three configuration parameters must be aligned (two at default, one - ddns-qualifying-suffix - set to a non-default non-empty value), so most default deployments are NOT vulnerable. Where that config is present, a remote unauthenticated attacker on a segment that can reach the DHCPv4 service can reliably crash it, which for a DHCP server means network-wide address-assignment outage. Net: treat as a real availability priority for Kea operators who set ddns-qualifying-suffix, but not a mass-exploitation network-vector RCE. No signals conflict; the main caveat is that vendor tags mischaracterize the impact.

An attacker able to send DHCPv4 traffic to a Kea server that has been configured with a non-empty ddns-qualifying-suffix (and default hostname-char-set / empty hostname-char-replacement) sends a DHCP message containing certain crafted option content. Processing that content triggers an out-of-range pointer condition (CWE-823) and kea-dhcp4 exits, denying DHCP service to all clients until restarted. No public exploit code is identified at time of analysis, though the ISC advisory describes the triggering conditions precisely.