CVE-2026-3608: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-3608 is a stack overflow vulnerability in ISC Kea DHCP software that allows unauthenticated remote attackers to crash affected daemons by sending a maliciously crafted message. The vulnerability affects the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, and kea-dhcp6 daemons when accessed over any configured API socket or High Availability (HA) listener. Affected versions are Kea 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2. It was publicly disclosed by ISC on March 25, 2026, with a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, oss-security).

The vulnerability is classified as CWE-617 (Reachable Assertion), with an estimated secondary classification of CWE-787 (Out-of-bounds Write) (Red Hat Advisory). An attacker can trigger the flaw by sending a specially crafted message to any of the four Kea daemons over an exposed API socket or HA listener interface, causing the daemon to exhaust its call stack and terminate with a stack overflow error. No authentication is required, and the attack complexity is low — the attacker only needs network access to the relevant socket or listener. The ISC knowledge base article provides the authoritative technical description (ISC KB).

Successful exploitation results in a denial-of-service condition: the targeted Kea daemon crashes and stops processing DHCP requests, DNS dynamic updates, or control-plane operations, depending on which daemon is targeted. In environments relying on Kea for DHCP infrastructure, this could disrupt IP address assignment across an entire network segment, potentially affecting all connected clients. There is no evidence of confidentiality or integrity impact — the vulnerability is purely an availability issue (Red Hat Advisory, oss-security).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The EPSS score is approximately 0.016% (0.000160), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction, making it straightforward to exploit if the API socket or HA listener is network-accessible.

1. Reconnaissance: Identify hosts running ISC Kea versions 2.6.0–2.6.4 or 3.0.0–3.0.2 using network scanning tools (e.g., Nmap, Shodan). Look for open ports associated with Kea's REST API (default TCP 8000) or HA listener endpoints.
2. Identify exposed interface: Determine whether the target exposes a Kea API socket (HTTP REST) or HA listener that is reachable from the attacker's network position.
3. Craft malicious message: Construct a specially crafted HTTP or socket message designed to trigger the stack overflow condition in the target daemon (kea-ctrl-agent, kea-dhcp4, kea-dhcp6, or kea-dhcp-ddns).
4. Send payload: Transmit the crafted message to the target daemon's API socket or HA listener endpoint without any authentication credentials.
5. Observe crash: The receiving daemon exits with a stack overflow error, causing denial of service for all DHCP, DDNS, or control-plane functions handled by that daemon (oss-security, Red Hat Advisory).

• Logs: Kea daemon logs showing unexpected termination with stack overflow or segmentation fault messages; system logs (/var/log/syslog, journalctl) recording abrupt daemon exits.
• Process: Absence of expected Kea daemon processes (kea-ctrl-agent, kea-dhcp4, kea-dhcp6, kea-dhcp-ddns) following a crash; repeated daemon restarts if supervised by systemd or similar.
• Network: Unusual or malformed HTTP POST requests to Kea REST API ports (default TCP 8000) from unexpected source IPs; anomalous traffic to HA listener ports from non-HA peer addresses.
• File System: Core dump files generated in the Kea working directory following daemon crashes, which may indicate exploitation attempts.

ISC has released patched versions: Kea 2.6.5 (for the 2.6.x branch) and Kea 3.0.3 (for the 3.0.x branch). Administrators should upgrade immediately to one of these versions (oss-security, ISC KB). As a workaround, implement network access controls (firewall rules, ACLs) to restrict access to Kea API sockets and HA listeners to only authorized and trusted hosts. Red Hat Enterprise Linux 10 users can apply RHSA-2026:7342 or RHSA-2026:11344 (Red Hat Errata). OpenSUSE, Fedora, and Ubuntu packages have also been updated through their respective security channels.

ISC's Peter Davies announced the vulnerability on the oss-security mailing list on March 25, 2026, simultaneously lifting the embargo and releasing patched versions (oss-security). Security news outlets including GBHackers, CyberSecurityNews, and CyberPress covered the disclosure, characterizing it as a critical warning for organizations relying on Kea for DHCP infrastructure. The vulnerability received attention on Bluesky and Mastodon/Infosec.exchange, with community discussion focused on the unauthenticated nature of the attack vector. Weekly threat landscape digests from Hawk-Eye and The Hacker News also included the vulnerability in their summaries.