# Kea 2.6.3 Security Release Notes, May 28, 2025 Welcome to Kea 2.6.3, a security release of the stable 2.6 series. This supersedes the previous release, version 2.6.2. Kea is a DHCP implementation developed by Internet Systems Consortium (ISC) that features DHCPv4 and DHCPv6 servers with DNS update and a REST API; optional database support (MySQL and PostgreSQL); optional RADIUS, Kerberos, YANG/NETCONF, and GSS-TSIG support; and much more. Kea provides extensive management capabilities, including but not limited to: TLS support, Role-Based Access Control, run-time configuration monitoring and updates via a REST API, host reservations, and client classification. The text below references issue numbers. For more details, visit the Kea GitLab page at https://gitlab.isc.org/isc-projects/kea/-/issues. For details about Docker issues, visit the page at https://gitlab.isc.org/isc-projects/kea-docker/-/issues/. For details about packaging, visit the page at https://gitlab.isc.org/isc-projects/kea-packaging/-/issues/. The following changes and fixes have been made in version 2.6.3: 1. **Security: Default configuration**: Running Kea with access to its API insufficiently secured poses significant risks and is strongly discouraged. The default configuration for the Kea Control Agent (CA) has been updated to enable basic HTTP authentication. Access to the Kea API will thus require a password. It also contains additional examples of stronger authentication, based on TLS certificates that only allow access to clients presenting valid TLS certificates. These changes address CVE-2025-32801, CVE-2025-32802, and CVE-2025-32803 [#3825, #3856]. 2. **Security: Hooks files**: To limit the severity of an attack via an insufficiently protected API, `kea-dhcp4`, `kea-dhcp6`, `kea-dhcp-ddns`, and `kea-ctrl-agent` now only load hook libraries from the default installation directory. Kea will not load the hook library if a path other than the default is specified. For ease of use, the path may be omitted. This change addresses CVE-2025-32801 [#3830, #3838]. 3. **Security: Config files**: To limit the scope of an attack on an insufficiently protected API, the API command `config-write` will now only write to the same directory as the configuration file used when Kea was started (passed as a `—c` argument). This change addresses CVE-2025-32802 [#3830, #3838]. 4. **Security: Lease files**: To mitigate the severity of an attack on an insufficiently protected API, lease files can now only be loaded from a defined data directory. The default data directory is determined during compilation: `[kea-install-dir]/var/lib/kea`. This path may be overridden at startup by setting the environment variable `KEA_DHCP_DATA_DIR` to the desired path. If a path outside the defined data directory is used in `lease-database.name`, Kea returns an error and refuses to start or, if already running, aborts and exits. For ease of use in specifying a custom file name, simply omit the path component from `name`. This change addresses CVE-2025-32802 [#3831, #3840]. 5. **Security: Log files**: To mitigate the severity of an attack on an insufficiently protected API, log files can now only be written to a defined output directory. The default directory is determined during compilation: `[kea-install-dir]/var/log/kea`. This path may be overridden at startup by setting the environment variable `KEA_LOG_FILE_DIR` to the desired path. If a path outside the defined output directory is used in `loggers.output_options.output`, Kea returns an error and refuses to start or, if already running, aborts and exits. For ease of use, simply omit the path component from `output` and specify only the file name. This change addresses CVE-2025-32802 [#3831, #3840]. 6. **Security: File permissions**: To prevent exposure of potentially confidential data, files created by Kea now have more restrictive file permissions. Write access by group and any access by others is now forbidden. This change addresses CVE-2025-32803 [#3832, #3842]. 7. **Security: Sockets**: To prevent unauthorized access and potential denial of service, sockets can no longer be created in a world-writable directory, such as `/tmp`. Sockets must now be created in the more restricted `[kea-install-dir]/var/run/kea`. This change addresses CVE-2025-32802 [#3831, #3840]. 8. **Security: Documentation**: Many sample configuration files have been updated to reflect changes introduced in this release. In the ARM, the Kea Security section has been moved to a more prominent location, and a new section concerning securing the Kea Control Agent has been added. These changes address CVE-2025-32801, CVE-2025-32802, and CVE-2025-32803 [#3833, #3844]. 9. **Build improvements**: The source code was updated to build with the latest Boost 1.87 [#3696, #3823]. 10. **Documentation update**: Backported a clarification in the ARM about subnet4-delta-add [#3773, #3869]. ## Incompatible Changes 1. The Kea Control Agent (CA) default configuration has API authentication enabled by default. A password must be stored in the `kea-api-password` file before the CA can start. This password should be either generated or provided by the administrator. When upgrading from older versions, it is strongly recommended not to leave the API channel unprotected. In addition, users are encouraged to consider enabling even stronger mechanisms, based on TLS certificates. An appropriately commented-out section has been added to the default configuration. 2. To mitigate the severity of an attack on an insufficiently protected API, Kea is now much more restrictive in where it allows files to be written. Operations that result in writing files (and potentially overwriting important system files) are no longer liberal in accepting random paths; the paths are restricted to expected locations for configuration, lease, DUID, and log files. Many of those can be overwritten by environment variables, but those are fixed for the entire lifetime of a process and are no longer modifiable via the API. The new default configurations have this change applied so new installations are secured, but please alter your configuration if upgrading. 3. To address potential denial-of-service and spoofing attacks, Kea no longer creates sockets in `/tmp`, which is a world-writable directory on most systems. Instead, it uses the ``[kea-installation-dir]/var/run/kea`` directory for sockets. The new default configurations have this change applied so new installations are secured, but please alter your configuration if upgrading. ## Known Issues A problem was discovered that can occur when Kea is configured incorrectly. This issue can cause the Kea process to print an error and terminate unexpectedly. For the problem to be triggered, all of the following conditions need to be met: 1. Global host reservations with an IP address are defined 2. The global reservation mechanism is disabled ("reservations-global": false) 3. Early global reservation lookup is enabled ("early-global-reservations-lookup": true) 4. A packet is received that matches a defined global host reservation It would be unusual to encounter the above environment under normal operation, because with the global reservation mechanism disabled (Condition 2) it does not make sense to define any global host reservations (Condition 1) or to enable early global reservation lookup (Condition 3). To avoid this unexpected shutdown, one or more of the conditions needs to be eliminated. This can be achieved in a number of ways: 1. If you are intending to deploy global reservations with the early reservation lookup feature, make sure that you enable "reservations-global" at the same time that you enable "early-global-reservations-lookup" in your configuration. 2. If you are already running Kea with global reservations but wish to stop using this functionality, temporarily or permanently, ensure that you disable both "reservations-global" and "early-global-reservations-lookup" in your configuration. 3. Remove global host reservations for your devices if they are not used. This issue affects all currently-supported versions of Kea. Although we have not tested EOL versions, we believe that this condition is present in all releases from 2.3.5 onwards. Future Kea versions will have improved error handling and will prevent this issue from happening. ## Acknowledgments ISC would like to thank Matthias Gerstner from the SUSE security team and Laura Pardo from Red Hat's Product Security Team for bringing this vulnerability to our attention. ## License This version of Kea is released under the Mozilla Public License, version 2.0. https://www.mozilla.org/en-US/MPL/2.0 Some Kea hook libraries are provided under the MPL 2.0; others are licensed with the Kea Hooks Basic Commercial End User License. The source for each hook library includes the applicable license. ## Download Pre-built ISC packages for current versions of the most popular Linux operating systems are available at: https://cloudsmith.io/~isc/repos/ Pre-built Docker images and well as Docker files are available. For details, see: https://gitlab.isc.org/isc-projects/kea-docker The Kea source and PGP signature for this release may be downloaded from: https://www.isc.org/download The signature was generated with the ISC code-signing key, which is available at: https://www.isc.org/pgpkey ISC provides detailed documentation, including installation instructions and usage tutorials, in the Kea Administrator Reference Manual. Documentation is included with the installation or at https://kea.readthedocs.io/en/latest/index.html in HTML, PDF, or EPUB formats. ISC maintains a public open source code tree, wiki, issue tracking system, milestone planner, and roadmap at https://gitlab.isc.org/isc-projects/kea. Limitations and known issues with this release can be found at https://gitlab.isc.org/isc-projects/kea/-/wikis/known-issues-list. We ask users of this software to please let us know how it worked for you and what operating system you tested on. Feel free to share your feedback on the Kea Users mailing list (https://lists.isc.org/mailman/listinfo/kea-users). We would also like to hear whether the documentation is adequate and accurate. Please open tickets in the Kea GitLab project for bugs, documentation omissions and errors, and enhancement requests. We want to hear from you even if everything worked. ## Support Professional support for Kea is available from ISC. We encourage all professional users to consider this option; Kea maintenance is funded with support subscriptions. For more information on ISC's Kea software support, see https://www.isc.org/support/. Free best-effort support is provided by our user community via a mailing list. Information on all public email lists is available at https://www.isc.org/community/mailing-list. If you have any comments or questions about working with Kea, please share them to the Kea Users list (https://lists.isc.org/mailman/listinfo/kea-users). Bugs and feature requests may be submitted via GitLab at https://gitlab.isc.org/isc-projects/kea/-/issues. ## Changes The following summarizes changes and important upgrades since the previous release, version 2.6.2. 2266. [build] andrei The library version numbers have been bumped up for the Kea 2.6.3 stable release. (Gitlab #3891) 2265. [sec]* fdupont Change the umask to no group write and no other access at the entry of Kea server/agent binaries. CVE:2025-32803 (Gitlab #3842, #3832) 2264. [sec]* tmark kea-dhcp4, kea-dhcp6, kea-dhcp-ddns, and kea-ctrl-agent will now only load hook libraries from the default installation directory. If a path other than this is specified Kea will not load the hook library. For ease of use, the path may be omitted. CVE:2025-32801 (Gitlab #3838, #3830) 2263. [build] fdupont, q66 Kea can now build with Boost 1.87. The minimum supported Boost version has been bumped up from 1.57 to 1.66. Thanks to q66 for the patch. (Gitlab #3823, #3696) 2262. [build] dim Replace ``std::basic_string`` with equivalent ``std::vector`` constructs, since the former has been deprecated for a while in libc++, and has been completely removed as of libc++ 19. (Gitlab #3823, #3532) There were no changes to the hook libraries, but please update hook libraries to the 2.6.3 version when updating your core application(s). Thank you again to everyone who assisted us in making this release possible. We look forward to receiving your feedback.