BSD PortsISC KEA -- kea-dhcp4 aborts if client sends a broadcast request with particular options
· CVE-2025-40779 · VuXML entry
Internet Systems Consortium, Inc. reports: We corrected an issue in `kea-dhcp4` that caused the server to abort if a client sent a broadcast request with particular options, and Kea failed to find an appropriate subnet for that client. This addresses CVE-2025-40779 [#4055, #4048].
Affected versions
- kea >= 3.0.0 < 3.0.1
- kea-devel >= 3.1.0 < 3.1.1; >= 2.7.1 <= 2.7.9
By system
0 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.