A Single Packet Can Crash a DHCP Server: High-Severity Flaw CVE-2025-40779 Found in Kea

The Internet Systems Consortium (ISC) has released a security advisory for a high-severity vulnerability in its Kea DHCP server, tracked as CVE-2025-40779 with a CVSS score of 7.5 that could allow a remote attacker to crash Kea with a single crafted packet.

According to the ISC bulletin, “If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the kea-dhcp4 process will abort with an assertion failure.” Notably, this issue only arises when requests are unicast directly to Kea; broadcast DHCP requests are not affected.

The vulnerability leads to a Denial of Service, with ISC explaining that “A malicious or misconfigured DHCP client can crash the Kea DHCPv4 service by sending a single packet.” The advisory lists vulnerable Kea versions as 2.7.1 to 2.7.9, 3.0.0, and 3.1.0, while versions 2.6.0 to 2.6.4 are not affected; ISC recommends upgrading to patched versions 3.0.1 or 3.1.1, and advises close monitoring of DHCP logs and segmenting untrusted devices where upgrades are not immediately possible.