CVE-2026-3608CWE-617

Stack overflow in Kea daemons

High · published March 25, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
68.1
In the wild
Unconfirmed
What it is

Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error.

This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01207 · 68.1th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2026-03-25T08:46Z
EPSS history
Timeline
  • 25 MAR 08:46Z
    Stack overflow in Kea daemons
    cvelistv5