SUSE-SU-2026:20989-1: kea&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:20989-1 is a vulnerability in kea&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 01-04-2026
   PublishedVulnerability first disclosed.
2. 10-04-2026
   Last modifiedVulnerability information updated.

Description

Security update for kea This update for kea fixes the following issues: Update to 3.0.3: - CVE-2025-11232: invalid characters cause assert (bsc#1252863). - CVE-2026-3608: stack overflow via maliciously crafted message (bsc#1260380). Changelog: * A large number of bracket pairs in a JSON payload directed to any endpoint would result in a stack overflow, due to recursive calls when parsing the JSON. This has been fixed. (CVE-2026-3608) [bsc#1260380] * When a hostname or FQDN received from a client is reduced to an empty string by hostname sanitizing, kea-dhcp4 and kea-dhcp6 will now drop the option. (CVE-2025-11232) [bsc#1252863] * A null dereference is now no longer possible when configuring the Control Agent with a socket that lacks the mandatory socket-name entry. * UNIX sockets are now created as group-writable. * Removed logging an error in ping check hook library if using lease cache treshold. * Fixed deadlock in ping-check hooks library. * Fixed a data race in ping-check hooks library.

No weakness data has been published for this record.