Is CVE-2026-3608 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3608 being exploited in the wild.

How severe is CVE-2026-3608?

High severity, with a CVSS score of 7.5, published 25 March 2026.

Which products and versions are affected?

Isc Kea 2.6.0 - 2.6.4, 3.0.0 - 3.0.2.

Is there a fix for CVE-2026-3608?

A patch was published on 2026-03-25: ISC released Kea 2.6.5 and 3.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3608 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3608?

Check whether you run Isc Kea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3608: ISC Kea stack overflow in multiple daemons via API socket

CVE-2026-3608 · Severity: high · CVSS 7.5 · Published 2026-03-25

ISC Kea is a widely used suite of DHCP server software that manages how devices on a network receive IP addresses. A vulnerability has been identified where a remote attacker can send a specially crafted message to the server's management or high-availability interfaces, causing the software to crash. This results in a denial-of-service, preventing new devices from joining the network or existing devices from renewing their network addresses.

Vendors: Isc.

Quick answers

Is CVE-2026-3608 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3608 being exploited in the wild.
How severe is CVE-2026-3608?: High severity, with a CVSS score of 7.5, published 25 March 2026.
Which products and versions are affected?: Isc Kea 2.6.0 - 2.6.4, 3.0.0 - 3.0.2.
Is there a fix for CVE-2026-3608?: A patch was published on 2026-03-25: ISC released Kea 2.6.5 and 3.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3608 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3608?: Check whether you run Isc Kea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack overflow vulnerability exists in several ISC Kea daemons, including kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, and kea-dhcp6. The issue is triggered when a daemon receives a maliciously crafted message over a configured API socket or High Availability (HA) listener. This leads to a reachable assertion or stack exhaustion (CWE-617), causing the process to terminate. The attack can be carried out remotely without authentication if the API or HA ports are exposed. ISC has released patches in versions 2.6.5 and 3.0.3. A recommended workaround is to enable TLS with mutual authentication (client certificates) for all API sockets to restrict access to trusted clients.

Affected products

ISC Kea 2.6.0 - 2.6.4, 3.0.0 - 3.0.2

Timeline

2026-03-18: other: Early notification provided by ISC
2026-03-25: advisory: Public disclosure of CVE-2026-3608
2026-03-25: patched: ISC released Kea 2.6.5 and 3.0.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.