VDB
CVE-2026-3608
CVE-2026-3608
PUBLISHED
CVSS 7.5 HIGH
Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.
EPSS 0.01% · 1.5th percentile
Risk Scores
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.01%
1.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ISC | Kea DHCP | |
| ISC | Kea | 2.6.0, 2.6.0, 3.0.0 |
| isc | kea | 2.6.0, 3.0.0, 2.6.0 |
Timeline
- Mar 25, 2026 EPSS Score
- Mar 25, 2026 Coalition ESS Score
- Mar 25, 2026 CVE Published
- Mar 25, 2026 PoC Published
- Mar 25, 2026 PoC Published
- Mar 25, 2026 PoC Published
- Mar 25, 2026 PoC Published
- Mar 25, 2026 PoC Published
- Mar 25, 2026 PoC Published
- Mar 25, 2026 CVE Updated
- Mar 27, 2026 PoC Published
- Mar 28, 2026 PoC Published