CVE-2026-3608 is a reachable assertion vulnerability in ISC Kea DHCP server components where sending a maliciously crafted message to any of the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over configured API sockets or HA listeners causes the daemon to exit due to a stack overflow error. This results in a denial of service condition. The vulnerability affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2. Red Hat Product Security has rated this vulnerability as important and has released security updates for Red Hat Enterprise Linux 10.0 Extended Update Support to remediate the issue.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by crashing the affected Kea DHCP daemons through a stack overflow triggered by a crafted message. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Red Hat has released security updates for affected Kea packages in Red Hat Enterprise Linux 10.0 Extended Update Support. Applying these official patches will remediate the vulnerability. Users should follow the Red Hat advisory instructions at https://access.redhat.com/articles/11258 to update their Kea packages. Since this is not a cloud service, remediation requires applying vendor-provided patches. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.