title: A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate
description: A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
problem types: An attacker who is able to send a request containing a malformed DUID to the server (either directly or via a relay) can cause the DHCPv6 server process to terminate, denying service to clients.  Only the DHCPv6 service is affected by this vulnerability.
affected:
{
product: Kea
vendor: ISC
versions:
status: affected, version: 1.4.0 to 1.5.0
status: affected, version: 1.6.0-beta1
status: affected, version: 1.6.0-beta2
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: Upgrade to a version of Kea containing a fix, available via
https://www.isc.org/downloads.
-  Kea 1.4.0-P2
-  Kea 1.5.0-P1
-  Kea 1.6.0