Vulnerability · Published Oct 29, 2025 · Assigned by isc
CVE-2025-11232Invalid characters cause assert
High 7.5
In plain English
A high-severity security flaw in Kea from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | kea-doc | 3.0.1-2.el10_1 | ALSA-2025:21038 |
| Rocky Linux:10 | kea | 0:3.0.1-2.el10_1 | RLSA-2025:21038 |
| Ubuntu:22.04:LTS | isc-kea | no fix listed | UBUNTU-CVE-2025-11232 |
| Ubuntu:24.04:LTS | isc-kea | no fix listed | UBUNTU-CVE-2025-11232 |
| Ubuntu:25.10 | isc-kea | no fix listed | UBUNTU-CVE-2025-11232 |
Affected products (as reported)
Weakness: CWE-823 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H