Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.
| Vendor | Product | Versions |
|---|---|---|
| ISC | Kea | 2.6.0, 3.0.0 |
Updated affected versions to include 2.6.5 and 3.0.3, and marked exploit availability and active exploitation as true.
Updated description with new details and clarified that there is no exploit available and it is not actively exploited.
Initial creation
