🛡️ openSUSE-SU-2026:20452-1 — kea (CVE-2025-11232 +1 more)

Security update for kea

This update for kea fixes the following issues:

Update to 3.0.3:

• CVE-2025-11232: invalid characters cause assert (bsc#1252863).
• CVE-2026-3608: stack overflow via maliciously crafted message (bsc#1260380).

Changelog:

• A large number of bracket pairs in a JSON payload directed to

any endpoint would result in a stack overflow, due to recursive

calls when parsing the JSON. This has been fixed.

(CVE-2026-3608)

[bsc#1260380]

• When a hostname or FQDN received from a client is reduced to an

empty string by hostname sanitizing, kea-dhcp4 and kea-dhcp6

will now drop the option.

(CVE-2025-11232)

[bsc#1252863]

• A null dereference is now no longer possible when configuring

the Control Agent with a socket that lacks the mandatory

socket-name entry.

• UNIX sockets are now created as group-writable.
• Removed logging an error in ping check hook library if using

lease cache treshold.

• Fixed deadlock in ping-check hooks library.
• Fixed a data race in ping-check hooks library.