# Kea 3.3.1 Release Notes, August 26, 2026 Welcome to Kea 3.3.1, a release of the 3.3 development series. As with any other development release, use this with caution: development releases are not recommended for production use. Kea is a DHCP implementation developed by Internet Systems Consortium (ISC) that features DHCPv4 and DHCPv6 servers with DNS update and a REST API; optional database support (MySQL and PostgreSQL); optional RADIUS, YANG/NETCONF, and Kerberos GSS-TSIG support; and much more. Kea provides extensive management capabilities, including but not limited to: TLS support, Role-Based Access Control, run-time configuration monitoring and updates via a REST API, host reservations, and client classification. The text below references issue numbers. For more details, visit the Kea GitLab page at https://gitlab.isc.org/isc-projects/kea/-/issues. For details about Docker issues, visit the page at https://gitlab.isc.org/isc-projects/kea-docker/-/issues/. For details about packaging, visit the page at https://gitlab.isc.org/isc-projects/kea-packaging/-/issues/. The following bug fixes and features have been implemented since the previous release: 1. **Configuration backend recovery**: We added a new `-R` command-line switch to `kea-dhcp4` and `kea-dhcp6`. It starts the server in configuration backend repair mode, allowing it to start and accept API commands even when otherwise-fatal errors in the configuration backend data would prevent normal startup. This provides administrators with a way to repair broken configuration backend data through the API [#4603]. 2. **Security and credentials**: MySQL and PostgreSQL passwords can now be read from a file using the new `password-file` parameter [#3959]. Database connection error messages no longer expose passwords in clear text [#4643]. PostgreSQL connection string values now properly escape single quotes and backslashes [#4659]. `kea-shell` gained the `--auth-user-file` command-line argument, which allows the user name for HTTP basic authentication to be read from a file [#4128]. HTTP basic authentication is now implemented for the dedicated HA listener; previously, its authentication configuration was silently ignored [#4599]. Path validation was also tightened to reject `.` and `..` as file names [#4647]. A security template for reporting issues was added [#4682]. 3. **Host reservations**: Kea now consistently gives subnet-level host reservations precedence over global reservations. A subnet-level reservation without a reserved address can also be used to select the subnet. These changes apply to both `kea-dhcp4` and `kea-dhcp6` [#4562, #4678, #4679]. 4. **Configuration**: The `control-socket` configuration keyword is now deprecated in `kea-dhcp4`, `kea-dhcp6`, and `kea-dhcp-ddns`. Configurations should use `control-sockets` instead [#4607]. 5. **DDNS**: We improved the D2 logic to avoid leaving orphaned PTR records when clients move between subnets or when forward records for the other IP version exist in dual-stack deployments [#4437]. 6. **Flex-ID hook**: The Flexible Identifier hook library gained a new `cid-as-rfc4361-duid` parameter. It allows a DHCPv4 flexible identifier to be formatted as an RFC 4361-compliant embedded DUID [#3780]. 7. **Lease-file handling**: Errors during `lease4-write` and `lease6-write` that leave the lease file unusable are now fatal and require manual recovery [#4649]. We also fixed an issue which could hide an invalid-row error when loading a memfile lease file produced by a newer Kea version [#4663]. We also improved I/O error handling [#4664]. 8. **Protocol and networking robustness**: DUID validation now rejects the `00:00:00` value used internally to represent an empty DUID [#4533, #4536, #4561]. The DNS name wire parser now limits compression-pointer hops and rejects cyclic or excessively long pointer chains with FORMERR instead of looping [#4652]. Recursive unpacking of DHCPv6 vendor options is now limited [#4692]. We corrected Bulk Lease Query TCP message framing [#4660] and another problem that could result in incorrect TCP message content under load [#4661]. HTTP socket writing now handles fatal and temporary write errors correctly [#4656,#4728]. We also removed spurious warnings emitted while HTTP listener sockets were being shut down [#4344,#4696]. The server now properly handles broken RELAY-FORW messages [#4735]. 9. **Bug fixes**: We fixed a possible null-pointer dereference while translating a YANG configuration that did not contain an `interfaces-config` node [#4667]. Very old MySQL upgrade scripts that could result in an incorrectly upgraded schema on the 8.1-to-8.2 and 9.6-to-10.0 upgrade paths were fixed [#4580]. We addressed incorrect handling of repeated DHCPv6 RELEASE messages when lease affinity is enabled, which could lead to incorrect assigned-lease statistics [#4670]. We fixed a problem that could crash both DHCPv4 and DHCPv6 servers while under heavy load with debug logging enabled [#4717,#4719,#4748]. The code-handling configuration is now thorough with checking data structure boundaries [#4640,#4636,#4637]. We replaced the unsafe sprintf with the safer snprintf function [#4726]. The data::copy() method now handles BigInt properly [#4639]. Extra checks were added for truncated buffers [#4666]. The buffer boundary checks in MySQL were improved [#4691]. The Content-Length header is now updated properly when a response is edited by the RBAC hook library [#3743]. We corrected error handling in MySQL selectQuery and host lookups [#4658]. 10. **SBOM**: We added a script that generates the Software Bill of Materials (SBOM) for Kea builds. Thank you to AdaLogics for developing this useful tool. [#3706]. 11. **Build improvements**: The hammer tool now properly handles upgrading NETCONF dependencies to newer versions [#4713]. We updated the Meson version to 1.12 in hammer, and the pyinstaller is now used with a specific version [#4757]. 12. **Testing**: More fuzzing harnesses were added to improve automated testing of Kea parsers and other input-handling code [#4272]. 13. **Investigated LLM Reports**: We investigated several LLM-reported issues [#4650, #4635, #4641, #4657, #4653, #4654, #4655] and determined the behavior is intentional or there was nothing specific to fix. 14. **Documentation**: Several Doxygen comments were improved [#4238]. 15. **Packaging**: The systemd scripts used in Kea packages can now handle extra custom options [#4688]. ## Incompatible Changes The following incompatible changes were introduced: 1. Path validation now rejects `.` and `..` as file names [#4647]. 2. Errors during the `lease4-write` and `lease6-write` commands that leave the resulting lease file unusable are now fatal and require manual recovery [#4649]. 3. The `control-socket` keyword that was deprecated since Kea 2.7 is no longer accepted. Please use `control-sockets` in DHCPv4, DHCPv6, and DDNS server configurations [#4607]. ## License This version of Kea is released under the Mozilla Public License, version 2.0. https://www.mozilla.org/en-US/MPL/2.0 Some Kea hook libraries are provided under the MPL 2.0; others are licensed with the [Kea Hooks Basic Commercial End User License](https://www.isc.org/kea-premium-license/). The source for each hook library includes the applicable license. ## Download Pre-built ISC packages for current versions of the most popular Linux operating systems are available at: https://cloudsmith.io/~isc/repos/ Pre-built Docker images, as well as Docker files, are available. For details, see: https://gitlab.isc.org/isc-projects/kea-docker The Kea source and PGP signature for this release may be downloaded from: https://www.isc.org/download The signature was generated with the ISC code-signing key, which is available at: https://www.isc.org/pgpkey ISC provides detailed documentation, including installation instructions and usage tutorials, in the Kea Administrator Reference Manual. Documentation is included with the installation or at https://kea.readthedocs.io/en/latest/index.html in HTML, PDF, or EPUB formats. ISC maintains a public open source code tree, wiki, issue tracking system, milestone planner, and roadmap at https://gitlab.isc.org/isc-projects/kea. Limitations and known issues with this release can be found at https://gitlab.isc.org/isc-projects/kea/-/wikis/known-issues-list. We ask users of this software to please let us know how it worked for you and what operating system you tested on. Feel free to share your feedback on the Kea Users mailing list (https://lists.isc.org/mailman/listinfo/kea-users). We would also like to hear whether the documentation is adequate and accurate. Please open tickets in the Kea GitLab project for bugs, documentation omissions and errors, and enhancement requests. We want to hear from you even if everything worked. ## Support Professional support for Kea is available from ISC. We encourage all professional users to consider this option; Kea maintenance is funded with support subscriptions. For more information on ISC's Kea software support, see https://www.isc.org/support/. Free best-effort support is provided by our user community via a mailing list. Information on all public email lists is available at https://www.isc.org/community/mailing-list. If you have any comments or questions about working with Kea, please share them to the Kea Users list (https://lists.isc.org/mailman/listinfo/kea-users). Bugs and feature requests may be submitted via GitLab at https://gitlab.isc.org/isc-projects/kea/-/issues. ## Changes The following summarizes the changes since the previous release. 2552. [build] tsawka The library version numbers have been bumped up for the Kea 3.3.1 development release. (Gitlab #4762) 2551. [build] AdaLogics Added a new tool to generate SBOMs for the Kea project. (Gitlab #3706) 2550. [bug] fdupont Fixed an issue in debug-level logging of dropped packets that could cause the server to crash under heavy load. Applies to both kea-dhcp4 and kea-dhcp6. (Gitlab #4659) 2549. [bug] fdupont Extended the DUID sanity checks to refuse the 00:00:00 DUID used internally to represent the empty DUID. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue. (Gitlab #4533) 2548. [bug] fdupont Errors that occur during "lease4-write" and "lease6-write" commands that leave the lease file unusable are now fatal. Recovery requires manual intervention. (Gitlab #4649) 2547. [func] fdupont Added a new argument, '--auth-user-file', which provides a secure method for supplying a user ID for basic HTTP authentication in kea-shell. (Gitlab #4128) 2546. [func] tmark Added -R command line switch to kea-dhcp4 and kea-dhcp6, which runs the server in config back end repair mode. This is a recovery mode that allows the server to start and process API commands in the event that otherwise fatal data errors have been introduced into config back end data. (Gitlab #4603) 2545. [func] fdupont Added support for using a file to configure MySQL and PostgreSQL passwords. Instead of configuring a value, it is taken from the content of a file. The new parameter is "password-file". (Gitlab #3959) 2544. [bug] wlodek Fixed Bulk Lease Query TCP connection read handler to erase only bytes consumed so message framing is preserved. (Gitlab #4660) 2543. [bug] wlodek, andrei Avoid logging passwords in clear text in log messages about database connection errors. (Gitlab #4643) 2542. [bug] fdupont Implemented HTTP basic authentication for HA dedicated listener, before such configuration was silently ignored. (Gitlab #4599) 2541. [bug] fdupont Limited recursive unpacking of DHCPv6 vendor options. (Gitlab #4692) 2540. [bug] wlodek, tmark Path validation now rejects "." and ".." file names as invalid (e.g. memfile lease database name ".."). (Gitlab #4647) 2539. [bug] wlodek The DNS Name wire parser now limits compression pointer hops, rejecting cyclic or excessively long pointer chains with FORMERR instead of looping. (Gitlab #4652) 2538. [bug] wlodek Escaped single quotes and backslashes in PostgreSQL connection string parameter values. (Gitlab #4659) 2537. [bug] wlodek, razvan HttpConnection::socketWriteCallback now returns after fatal write errors and treats EAGAIN/EWOULDBLOCK like the HTTP client send path, avoiding fallthrough and duplicate doWrite. (Gitlab #4656) 2536. [func] fdupont The "control-socket" keyword is deprecated in favor of "control-sockets" in DHCPv4, DHCPv6 and DDNS server configurations. (Gitlab #4607) 2535. [build] andrei, razvan, AdaLogics More fuzz harnesses were added. (Gitlab #4272) 2534. [bug] fdupont Fixed incorrect handling of double DHCPV6_RELEASE when the lease affinity feature is enabled, e.g. leading to incorrect assigned statistics. (Gitlab #4670) 2533. [bug] fdupont Fixed spurious warnings emitted on shutdown when some HTTP socket listen for new connections. (Gitlab #4344) 2532. [bug] wlodek,tmark Fixed an issue which might result in incorrect TCP message content under load. (Gitlab #4661) 2531. [bug] wlodek, tmark Corrected an issue that could mask an invalid row error while loading a Memfile lease file generated from a newer version of Kea. (Gitlab #4663) 2530. [bug] wlodek,tmark Fixed a null ElementPtr dereference in TranslatorConfig::getInterfacesKea when the YANG config has no interfaces-config node. (Gitlab #4667) 2529. [func] tmark Modified D2 logic to avoid orphaning PTR records when clients have changed subnets or there are forward resource records of the other IP version in a dual-stack environment. (Gitlab #4437) 2528. [bug] tmark Kea now consistently prioritizes subnet-level hosts over global hosts and allows subnet-level hosts without a reserved address to select the subnet. Applies to kea-dhcp4 and kea-dhcp6. (Gitlab #4678, #4679, #4562) 2527. [func] tmark Added ``cid-as-rfc4361-duid`` flag to flex-id hook library. This allows the v4 flex-id to be formatted as an RFC 4361 compliant embedded DUID. (Gitlab #3780) 2526. [bug] andrei Fixed an issue with some very old upgrade scripts that could have led to split MySQL schemas - specifically on the 8.1->8.2 upgrade path, the array column would have not been renamed to is_array, and on 9.6->10.0, the server tag column would have not been resized. (Gitlab #4580) 2525. [bug] razvan Corrected MLM_MYSQL_FETCH_FAILURE to 1 so MySQL selectQuery and host lookups detect mysql_stmt_fetch errors instead of silently ignoring them. (Gitlab #4658) Thank you again to everyone who assisted us in making this release possible. We look forward to receiving your feedback.