CVE-2025-40779
BaseFortify
Publication date: 2025-08-27
Last updated on: 2025-11-04
Assigner: Internet Systems Consortium (ISC)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| isc | kea | 3.0.0 |
| isc | kea | 2.7.9 |
| isc | kea | 2.7.3 |
| isc | kea | 2.7.1 |
| isc | kea | 2.7.5 |
| isc | kea | 2.7.2 |
| isc | kea | 2.7.4 |
| isc | kea | 3.1.0 |
| isc | kea | 2.7.7 |
| isc | kea | 2.7.6 |
| isc | kea | 2.7.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Kea DHCP server versions 2.7.1 through 2.7.9, 3.0.0, and 3.1.0. When a DHCPv4 client sends a request with certain specific options and Kea cannot find an appropriate subnet for that client, the kea-dhcp4 process crashes due to an assertion failure. This crash happens only if the client request is sent via unicast directly to the Kea server; broadcast requests do not cause this issue. The crash results in the DHCP service stopping, causing a denial of service. [1]
How can this vulnerability impact me? :
The impact of this vulnerability is a denial of service (DoS) condition on the DHCPv4 service. A single malicious or misconfigured DHCP client sending a crafted unicast request can cause the kea-dhcp4 process to abort, disrupting DHCP service availability. This can prevent clients from obtaining IP addresses, potentially causing network outages or connectivity issues. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Kea DHCP server to the patched versions 3.0.1 or 3.1.1, depending on your current version. There are no known workarounds, so applying the update is the recommended immediate step to prevent the kea-dhcp4 process from aborting and causing a denial of service. [1]