CVE-2025-11232: Invalid characters cause assert
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must NOT be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ISC Keato a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
ISC Keato a version that resolves this vulnerability.Fixed in 3.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11232?
CVE-2025-11232 is assessed with a medium severity level, indicating potential risks to affected systems.
How do I fix CVE-2025-11232?
To mitigate CVE-2025-11232, ensure that the configuration parameters "hostname-char-set" and "hostname-char-replacement" are correctly set, and that "ddns-qualifying-suffix" is configured properly.
What software versions are affected by CVE-2025-11232?
CVE-2025-11232 affects Kea DHCP versions 3.0.1 and 3.1.1 to 3.1.2.
What are the specific configuration parameters involved in CVE-2025-11232?
The specific parameters involved in CVE-2025-11232 are "hostname-char-set", "hostname-char-replacement", and "ddns-qualifying-suffix".
Can CVE-2025-11232 lead to denial of service?
Yes, if exploited, CVE-2025-11232 can potentially compromise the availability of the affected Kea DHCP server.