ISC Patches High-Severity Kea DHCPv4 DoS (CVE-2025-11232) Flaw, Allows Crash via Malformed Hostname

The Internet Systems Consortium (ISC) has issued a security advisory warning of a high-severity denial-of-service flaw in Kea DHCPv4, tracked as CVE-2025-11232 and rated CVSS 7.5. According to ISC’s advisory, three configuration parameters must have specific settings for the issue to trigger: ‘hostname-char-set’ must be left at the default setting, which is ‘[^A-Za-z0-9.-]’; ‘hostname-char-replacement’ must be empty (the default); and ‘ddns-qualifying-suffix’ must NOT be empty (the default is empty).

Under these conditions, a client that sends a DHCP request containing invalid or unexpected hostname characters can cause kea-dhcp4 to exit unexpectedly, potentially disrupting IP address assignments across networks. While the crash does not enable remote code execution or data loss, repeated exploitation could produce a sustained DoS by denying network connectivity for DHCP clients.

Upgrades to patched releases 3.0.2 or 3.1.3 are advised for users running vulnerable versions 3.0.1–3.0.1 and 3.1.1–3.1.2; as a temporary workaround, setting ‘hostname-char-replacement’ to anything other than an empty value (for example: ‘x’) can prevent the assertion failure.