Internet Systems Consortium Kea Vulnerability Allows Denial of Service

CERT-Bund has released a security advisory (WID-SEC-2026-0887) detailing a critical vulnerability in Internet Systems Consortium (ISC) Kea, an open-source DHCP server. The vulnerability, rated with a CVSS base score of 7.5 (high), allows remote, anonymous attackers to exploit a flaw to cause a denial of service (DoS) condition. Affected versions are ISC Kea prior to 2.6.5 and prior to 3.0.3.

Organizations utilizing ISC Kea should immediately review their installed versions. Mitigation is available, and affected users are strongly advised to update to a patched version or implement available workarounds to prevent potential service disruptions. The advisory highlights the need for prompt patching to maintain network stability and security.