Description
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.
Problem types
CWE-823 Use of Out-of-range Pointer Offset
Product status
3.0.1 (custom)
3.1.1 (custom)
2.6.0 (custom)
2.7.0 (custom)
3.0.0 (custom)
3.1.0 (custom)
Credits
ISC would like to thank Siniša Uskoković and Ralf Steuer from Vienna University of Economics and Business for bringing this vulnerability to our attention.
References
kb.isc.org/docs/cve-2025-11232 (CVE-2025-11232)
