Junglewise Threat Intelligence

CVE-2026-3608: ISC Kea stack overflow in multiple daemons via API socket

CVE-2026-3608 · Severity: high · CVSS 7.5 · Published 2026-03-25

Vendors: Isc.

Executive brief

ISC Kea is a widely used suite of DHCP server software that manages how devices on a network receive IP addresses. A vulnerability has been identified where a remote attacker can send a specially crafted message to the server's management or high-availability interfaces, causing the software to crash. This results in a denial-of-service, preventing new devices from joining the network or existing devices from renewing their network addresses.

Technical details

A stack overflow vulnerability exists in several ISC Kea daemons, including kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, and kea-dhcp6. The issue is triggered when a daemon receives a maliciously crafted message over a configured API socket or High Availability (HA) listener. This leads to a reachable assertion or stack exhaustion (CWE-617), causing the process to terminate. The attack can be carried out remotely without authentication if the API or HA ports are exposed. ISC has released patches in versions 2.6.5 and 3.0.3. A recommended workaround is to enable TLS with mutual authentication (client certificates) for all API sockets to restrict access to trusted clients.

Affected products

  • ISC Kea 2.6.0 - 2.6.4, 3.0.0 - 3.0.2

Timeline

  • 2026-03-18: other: Early notification provided by ISC
  • 2026-03-25: advisory: Public disclosure of CVE-2026-3608
  • 2026-03-25: patched: ISC released Kea 2.6.5 and 3.0.3

References