Failure to release memory may exhaust system resources

Published 7 y ago 2019-01-16 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.9%

percentile 80%

Public exploits

none known

An extension to hooks capabilities which debuted in Kea 1.4.0 introduced a memory leak for operators who are using certain hooks library facilities. In order to support multiple requests simultaneously, Kea 1.4 added a callout handle store but unfortunately the initial implementation of this store does not properly free memory in every case. Hooks which make use of query4 or query6 parameters in their callouts can leak memory, resulting in the eventual exhaustion of available memory and subsequent failure of the server process. Affects Kea DHCP 1.4.0.

Exploit prediction (EPSS)

1.89% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	6.5	`CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
CNA	3.0	6.5	`CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:N/A:P`

Affected products

ISC Kea DHCP

Classification

Weakness

CWE-772 Missing Release of Resource after Effective Lifetime

References

kb.isc.org /docs/aa-01626 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-5739
NVD: CVE-2018-5739

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.