CVE catalog

CVE-2025-32801

isc-kea: CVE-2025-32801

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.30% · Oct 25, 2026

Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianisc-keasid3.0.4-2fixed
Debianisc-keaforky3.0.4-2fixed
Debianisc-keatrixie2.6.3-1+deb13u1fixed
Debianisc-keabookworm2.2.0-6vulnerable
Alpinekea3.222.6.3-r0fixed
Alpinekea3.232.6.3-r0fixed
Alpinekea3.242.6.3-r0fixed
Ubuntuisc-kea24.042.2.1-3vulnerable
Ubuntuisc-kea24.042.4.0-1vulnerable
Ubuntuisc-kea24.042.4.1-1vulnerable
Ubuntuisc-kea24.042.4.1-2build1vulnerable
Ubuntuisc-kea24.042.4.1-3build1vulnerable
Ubuntuisc-kea24.042.4.1-3build3vulnerable
Ubuntuisc-kea24.042.4.1-3build3.1vulnerable
Ubuntuisc-kea24.042.4.1-3ubuntu0.1vulnerable
Ubuntuisc-kea24.042.4.1-3ubuntu0.2vulnerable
Susekealinux enterprise server 15 sp6-ltss2.6.3-150600.13.6.1fixed
Susekealinux enterprise server for sap applications 15 sp62.6.3-150600.13.6.1fixed
Opensusekealeap 15.62.6.3-150600.13.6.1fixed
Opensusekeatumbleweed2.6.3-1.1fixed
Susekealinux enterprise module for basesystem 15 sp72.6.3-150700.3.3.5fixed
Susekealinux enterprise module for server applications 15 sp72.6.3-150700.3.3.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianisc-keasourcesid2.6.3-1not yet assignedNot reported[1106737]
Debianisc-keasourceforky2.6.3-1not yet assignedNot reported[1106737]
Debianisc-keasourcetrixie2.6.3-1not yet assignedNot reported[1106737]
Debianisc-keasourcebookworm(unfixed)not yet assignedNot reported[1106737]
Alpinekeaapk3.222.6.3-r0Not reportedALPINE-CVE-2025-32801Not reported
Alpinekeaapk3.232.6.3-r0Not reportedALPINE-CVE-2025-32801Not reported
Alpinekeaapk3.242.6.3-r0Not reportedALPINE-CVE-2025-32801Not reported
Susekearpmlinux enterprise server 15 sp6-ltss2.6.3-150600.13.6.1Not reportedSUSE-SU-2026:1091-1Not reported
Susekearpmlinux enterprise server for sap applications 15 sp62.6.3-150600.13.6.1Not reportedSUSE-SU-2026:1091-1Not reported
Opensusekearpmleap 15.62.6.3-150600.13.6.1Not reportedSUSE-SU-2026:1091-1Not reported
Opensusekearpmtumbleweed2.6.3-1.1Not reportedOPENSUSE-SU-2025:15181-1Not reported
Susekearpmlinux enterprise module for basesystem 15 sp72.6.3-150700.3.3.5Not reportedSUSE-SU-2026:0907-1Not reported
Susekearpmlinux enterprise module for server applications 15 sp72.6.3-150700.3.3.5Not reportedSUSE-SU-2026:0907-1Not reported

[Debian bug #1106737]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [kea]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · all · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · all · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

  • [kea-admin]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · amd64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · arm64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

  • [kea-common]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · amd64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · arm64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

  • [kea-ctrl-agent]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · amd64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · arm64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

  • [kea-dev]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · amd64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · arm64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

  • [kea-dhcp4-server]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · amd64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · arm64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

  • [kea-dhcp6-server]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · amd64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · arm64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

  • [kea-dhcp-ddns-server]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · amd64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · arm64 · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

  • [kea-doc]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · all · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · all · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

  • [python3-kea-connector]Affected

    Source package: [isc-kea]

    Details (2)

    • 2.2.0-6 · all · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

    • 2.2.0-6 · all · bookworm

      Affected

      dsa · isc-kea · debian · bookworm; dsa · isc-kea · debian · 12

[openSUSE Tumbleweed]

  • [kea-devel]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

  • [kea-doc]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · noarch · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

  • [kea-hooks]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

  • [libkea-asiodns75]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

  • [libkea-asiolink105]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

  • [libkea-cc98]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

  • [libkea-cfgrpt3]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

  • [libkea-config98]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

  • [libkea-cryptolink76]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

  • [libkea-d2srv75]Unknown

    Source package: [kea]

    Details (1)

    • 3.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.6.3-1.1

      Version impact unknown

      dsa · kea · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]