7.5

CVE-2026-3608: isc kea Reachable Assertion

CVSS: 7.5v3.1HighAwaiting analysis
AliasesALPINE-CVE-2026-3608SUSE-SU-2026:1378-1SUSE-SU-2026:1548-1
Published 25-03-2026Last modified 15-07-2026
Open JSON

Vulnerability summary

CVE-2026-3608 is a high (CVSS 7.5) Reachable Assertion vulnerability in isc kea. EPSS estimates a 1.16% chance of exploitation in the next 30 days, higher than 66.7% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.16%
0%100%
Low · -0.20 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:20452-1SUSE-SU-2026:20989-1USN-8403-1

Timeline

  1. 25-03-2026
    PublishedVulnerability first disclosed.
  2. 15-07-2026
    Last modifiedVulnerability information updated.

Description

Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

1.16%

Chance of exploitation in the next 30 days

Percentile

67%

Versus all other CVEs

30-day change

-0.20 pp

From 1.36% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat11 products
  • kea< 0:2.6.3-2.el10_0.3 | < 0:3.0.1-3.el10_1
  • kea-debuginfo< 0:2.6.3-2.el10_0.3 | < 0:3.0.1-3.el10_1
  • kea-debugsource< 0:2.6.3-2.el10_0.3 | < 0:3.0.1-3.el10_1
  • kea-devel-debuginfo< 0:3.0.1-3.el10_1
  • kea-doc< 0:2.6.3-2.el10_0.3 | < 0:3.0.1-3.el10_1
Suse4 products
  • kea&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 2.6.5-150700.3.6.1
  • kea&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7< 2.6.5-150700.3.6.1
  • kea&distro=SUSE Linux Enterprise Server 15 SP6-LTSS< 2.6.5-150600.13.9.1
  • kea&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6< 2.6.5-150600.13.9.1
Alpine1 product
  • kea< 2.6.5-r0 | < 3.0.3-r0
Debian1 product
  • isc-keaAll versions (No fix recorded) | < 2.6.3-1+deb13u1 | < 3.0.3-1
Isc1 product
  • kea≥ 2.6.0, ≤ 2.6.4 | ≥ 3.0.0, ≤ 3.0.2
Opensuse1 product
  • kea&distro=openSUSE Tumbleweed< 3.0.3-1.1
Ubuntu1 product
  • isc-keaAll versions (No fix recorded) | < 2.4.1-3ubuntu0.2 | < 2.6.3-2ubuntu0.1

7 vendors · 20 products

References

22 links
Show all 22 references