CVE-2026-3608 Stack overflow in Kea daemons
Attackers can crash Kea DHCP daemons by sending malicious messages to API sockets or HA listeners, causing a stack overflow and service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3608?
CVE-2026-3608 is a high-severity denial of service vulnerability in ISC Kea, published on 25 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.
Weakness: CWE-617
Which versions are affected by CVE-2026-3608?
Linux distribution packages (28)
kea-doc AlmaLinux:10 | All versions | 3.0.1-3.el10_1 |
kea Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-devel-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-doc Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-hooks Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-hooks-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-keama Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-keama-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-libs Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea-libs-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.0.1-3.el10_1 |
kea Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea-doc Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea-hooks Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea-hooks-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea-keama Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea-keama-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea-libs Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea-libs-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.6.3-2.el10_0.3 |
kea Rocky Linux:10 | All versions | 0:3.0.1-3.el10_1 |
kea SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.6.5-150700.3.6.1 |
kea SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 2.6.5-150700.3.6.1 |
kea SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 2.6.5-150600.13.9.1 |
kea SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 2.6.5-150600.13.9.1 |
kea openSUSE:Tumbleweed | All versions | 3.0.3-1.1 |
How do I fix CVE-2026-3608?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-3608 being exploited?
There is no known exploitation of CVE-2026-3608 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-3608, ALSA-2026:7342, DEBIAN-CVE-2026-3608, GHSA-8xcr-6f99-hm7w, RHSA-2026:11344, RHSA-2026:7342 and 5 more.