CVE-2025-11232: Invalid characters cause assert
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must NOT be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11232?
CVE-2025-11232 is assessed with a medium severity level, indicating potential risks to affected systems.
How do I fix CVE-2025-11232?
To mitigate CVE-2025-11232, ensure that the configuration parameters "hostname-char-set" and "hostname-char-replacement" are correctly set, and that "ddns-qualifying-suffix" is configured properly.
What software versions are affected by CVE-2025-11232?
CVE-2025-11232 affects Kea DHCP versions 3.0.1 and 3.1.1 to 3.1.2.
What are the specific configuration parameters involved in CVE-2025-11232?
The specific parameters involved in CVE-2025-11232 are "hostname-char-set", "hostname-char-replacement", and "ddns-qualifying-suffix".
Can CVE-2025-11232 lead to denial of service?
Yes, if exploited, CVE-2025-11232 can potentially compromise the availability of the affected Kea DHCP server.