CVE-2025-11232

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.isc.org/docs/cve-2025-11232
http://www.openwall.com/lists/oss-security/2025/10/29/5

Configurations

No configuration.

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Para desencadenar el problema, tres parámetros de configuración deben tener ajustes específicos: 'hostname-char-set' debe dejarse en la configuración predeterminada, que es '[^A-Za-z0-9.-]'; 'hostname-char-replacement' debe estar vacío (el valor predeterminado); y 'ddns-qualifying-suffix' NO debe estar vacío (el valor predeterminado es vacío). Las actualizaciones DDNS no necesitan estar habilitadas para que este problema se manifieste. Un cliente que envía cierto contenido de opción provocaría entonces que kea-dhcp4 se cierre inesperadamente. Este problema afecta a las versiones de Kea 3.0.1 a 3.0.1 y 3.1.1 a 3.1.2.

Information

Published : 2025-10-29 18:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-11232

Mitre link : CVE-2025-11232

CVE.ORG link : CVE-2025-11232

JSON object : View

Products Affected

No product.

CWE

CWE-823

Use of Out-of-range Pointer Offset

{"id": "CVE-2025-11232", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11232", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-29T18:22:07.119804Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "Kea", "versions": [{"status": "affected", "version": "3.0.1", "versionType": "custom", "lessThanOrEqual": "3.0.1"}, {"status": "affected", "version": "3.1.1", "versionType": "custom", "lessThanOrEqual": "3.1.2"}, {"status": "unaffected", "version": "2.6.0", "versionType": "custom", "lessThanOrEqual": "2.6.4"}, {"status": "unaffected", "version": "2.7.0", "versionType": "custom", "lessThanOrEqual": "2.7.9"}, {"status": "unaffected", "version": "3.0.0", "versionType": "custom", "lessThanOrEqual": "3.0.0"}, {"status": "unaffected", "version": "3.1.0", "versionType": "custom", "lessThanOrEqual": "3.1.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-29T18:15:40.197", "references": [{"url": "https://kb.isc.org/docs/cve-2025-11232", "source": "security-officer@isc.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/29/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-823"}]}], "descriptions": [{"lang": "en", "value": "To trigger the issue, three configuration parameters must have specific settings: \"hostname-char-set\" must be left at the default setting, which is \"[^A-Za-z0-9.-]\"; \"hostname-char-replacement\" must be empty (the default); and \"ddns-qualifying-suffix\" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly.\nThis issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2."}, {"lang": "es", "value": "Para desencadenar el problema, tres par\u00e1metros de configuraci\u00f3n deben tener ajustes espec\u00edficos: 'hostname-char-set' debe dejarse en la configuraci\u00f3n predeterminada, que es '[^A-Za-z0-9.-]'; 'hostname-char-replacement' debe estar vac\u00edo (el valor predeterminado); y 'ddns-qualifying-suffix' NO debe estar vac\u00edo (el valor predeterminado es vac\u00edo). Las actualizaciones DDNS no necesitan estar habilitadas para que este problema se manifieste. Un cliente que env\u00eda cierto contenido de opci\u00f3n provocar\u00eda entonces que kea-dhcp4 se cierre inesperadamente. Este problema afecta a las versiones de Kea 3.0.1 a 3.0.1 y 3.1.1 a 3.1.2."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "security-officer@isc.org"}