Medium severity · published Oct 16, 2019
CVE-2019-6474
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the…
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kea · Isc
1.4.0 through 1.5.0; 1.6.0; 1.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6474
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6474
Vendor Advisory
https://kb.isc.org/docs/cve-2019-6474
More from Kea
7.5
CVE-2026-3608
Stack overflow in Kea daemons
7.5
CVE-2025-40779
Kea crash upon interaction between specific client options and subnet selection
7.5
CVE-2018-5739
Failure to release memory may exhaust system resources
6.8
CVE-2015-8373
The kea-dhcp4 and kea-dhcp6 servers 0.9.2 and 1.0.0-beta in ISC Kea, when certain debugging settings are used, allow remote attackers to cause a denial of service (daemon crash)…
6.5
CVE-2019-6472
A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure