A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate

Description

A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2

Scores

EPSS (exploitation in 30 days)

0.72% · top 46% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.7.

Weakness

• Only Kea servers which use memfile storage for leases are affected by this vulnerability. An attacker can exploit the missing check to deliberately create a situation where the server will not restart properly should it stop for any reason.
• CWE-772 (opens in a new tab)All about CWE-772 and its CVEs

Affected products

• ISC · Kea

  • affected 1.4.0 to 1.5.0
  • affected 1.6.0-beta1
  • affected 1.6.0-beta2

What to do

Solution: Upgrade to a version of Kea containing a fix, available via https://www.isc.org/downloads. - Kea 1.4.0-P2 - Kea 1.5.0-P1 - Kea 1.6.0

References (1)

• https://kb.isc.org/docs/cve-2019-6474 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-6474](https://trackcve.app/badge/CVE-2019-6474.svg)](https://trackcve.app/cve/CVE-2019-6474)

Record last updated 16 Sept 2024, 22:19 UTC.