CVE-2026-3608

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
ISC	Kea	>= 2.6.0, <= 2.6.4; >= 3.0.0, <= 3.0.2
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	—

References

Timeline

Published: Mar 25, 2026
Last modified: Jul 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-36097.8Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides a CVE-2026-36104.3A vulnerability was found in HSC Cybersecurity Mailinspector up to 5.3.2-3. Affected by this issue is some unknown functionality of the file CVE-2026-361027.2An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate priv CVE-2026-361110.0The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuratio CVE-2026-36127.2A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the compo CVE-2026-36137.2A vulnerability was identified in Wavlink WL-NU516U1 V240425. This vulnerability affects the function sub_401A0C of the file /cgi-bin/login.CVE-2026-36148.8The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a CVE-2026-36166.3A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the f CVE-2026-361625.4An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to exe CVE-2026-361635.4An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScri CVE-2026-36176.4The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in a CVE-2026-361744.6GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console