CVE-2025-11232

Invalid characters cause assert

State: Published
Severity: 7.5 High
Published: Oct 29, 2025
Updated: Nov 4, 2025
Reserved: Oct 1, 2025

Description

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	isc

Weaknesses

CWE-823 Use of Out-of-range Pointer Offset

Affected Products

Product	Versions
KeaISC	3.0.1 through 3.0.1Affected 3.1.1 through 3.1.2Affected 2.6.0 through 2.6.4Not affected 2.7.0 through 2.7.9Not affected 3.0.0 through 3.0.0Not affected 3.1.0 through 3.1.0Not affected

References

CVE-2025-11232vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.