CVE-2025-40779 Kea crash upon interaction between specific client options and subnet selection
A remote attacker can crash the Kea DHCP server by sending specific unicast requests when no subnet matches, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40779?
CVE-2025-40779 is a high-severity vulnerability in ISC Kea, published on 27 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort with an assertion failure. This happens only if the client request is unicast directly to Kea; broadcast messages do not cause the problem. This issue affects Kea versions 2.7.1 through 2.7.9, 3.0.0, and 3.1.0.
Weakness: CWE-476
Which versions are affected by CVE-2025-40779?
Linux distribution packages (13)
kea Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-devel-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-doc Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-hooks Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-hooks-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-keama Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-keama-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-libs Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea-libs-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-1.el10_1 |
kea openSUSE:Leap 16.0 | All versions | 3.0.1-160000.1.1 |
kea openSUSE:Tumbleweed | All versions | 3.0.1-1.1 |
How do I fix CVE-2025-40779?
Upgrade to a fixed version.
Is CVE-2025-40779 being exploited?
There is no known exploitation of CVE-2025-40779 in the wild and no public exploit code.
Sources
Also known as GHSA-v32h-8f7r-3543, RHSA-2025:21006, openSUSE-SU-2025:15499-1, openSUSE-SU-2026:20341-1.