ISC Fixes Kea DHCPv4 Bug That Lets Attackers Crash Server

The Internet Systems Consortium has released a patch for a high-severity vulnerability in the Kea DHCPv4 server that could allow attackers to crash the service using a specially crafted hostname. Tracked as CVE-2025-11232 and rated 7.5 on the CVSS scale, the flaw poses a significant risk to network stability. ISC fixes Kea DHCPv4 bug in response to this denial-of-service vulnerability, which impacts deployments relying on the DHCPv4 protocol to manage IP address assignments.

According to the advisory, a malformed hostname can trigger an unexpected failure in affected versions, leading to service disruption. Administrators are urged to update to the latest version immediately to mitigate risks. ISC fixes Kea DHCPv4 bug by addressing the input handling weakness that made the crash possible. The advisory also references several other CVEs, highlighting broader security concerns across multiple components.

For more details, read the full advisory at

ISC Patches High-Severity Kea DHCPv4 DoS (CVE-2025-11232) Flaw, Allows Crash via Malformed Hostname