high7.8
CVE-2025-32801
Kea configuration and API directives can be used to load a malicious hook library.
Impact
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Affected products
| Product | Affected versions |
|---|---|
| Kea Versions 2.4.0 | through 2.4.1 |
| 2.6.0 | through 2.6.2 |
| And 2.7.0 | through 2.7.8. |
Versions were read from the advisory text. No structured product data has been published for this record yet.