CVE-2026-3608
High · 7.5CVSS
7.5
EPSS
1.2%
Published
Mar 25, 2026
CISA due date
—
The record
Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | kea | 0 | 3.0.3-160000.1.1 |
| openSUSE:Tumbleweed | kea | 0 | 3.0.3-1.1 |
Related vulnerabilities
- CVE-2025-11232 To trigger the issue, three configuration parameters must have specific settings… Also affects kea
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-617
- CVE-2026-105753 vLLM is an inference and serving engine for large language models. CWE-617
- CVE-2026-98151 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG… CWE-617
- CVE-2026-84450 libheif is a HEIF and AVIF file format decoder and encoder. CWE-617
- CVE-2026-8674 Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN… CWE-617
- CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the… CWE-617
- CVE-2026-76163 If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block… CWE-617