# Kea 3.1.3 Release Notes, October 29, 2025 Welcome to Kea 3.1.3, a maintenance release of the 3.1 development series. As with any other development release, use this with caution: development releases are not recommended for production use. Kea is a DHCP implementation developed by Internet Systems Consortium (ISC) that features DHCPv4 and DHCPv6 servers with DNS update and a REST API; optional database support (MySQL and PostgreSQL); optional RADIUS, YANG/NETCONF, and Kerberos GSS-TSIG support; and much more. Kea provides extensive management capabilities, including but not limited to: TLS support, Role-Based Access Control, run-time configuration monitoring and updates via a REST API, host reservations, and client classification. The text below references issue numbers. For more details, visit the Kea GitLab page at https://gitlab.isc.org/isc-projects/kea/-/issues. For details about Docker issues, visit the page at https://gitlab.isc.org/isc-projects/kea-docker/-/issues/. For details about packaging, visit the page at https://gitlab.isc.org/isc-projects/kea-packaging/-/issues/. The following bug fixes and features have been implemented since the previous release: 1. **Vulnerability**: We corrected an issue where specific DDNS configuration parameters resulted in `kea-dhcp4` exiting unexpectedly when a client sent certain option content [#4142,#4152]. 2. **Ping check**: A debug log message is now printed instead of a misleading error message when the lease-cache threshold is used along with ping check [#4129]. We corrected a potential deadlock situation in ping check [#4140]. We fixed a data race in ping check [#4164]. 3. **New statistics**: New statistics were added to better track the number of packets dropped for various reasons: `pkt4-limit-exceeded` and `pkt6-limit-exceeded` when dropped by the limits hook [#4134]; `pkt4-queue-full` and `pkt6-queue-full` when dropped due to the packet queue being full [#4157]; `pkt4-rfc-violation` and `pkt6-rfc-violation` when an incoming packet did not follow the RFC specifications [#4156]; `pkt4-admin-filtered` and `pkt6-admin-filtered` when the server was administratively configured to reject the packet, e.g. by the `DROP` class [#4127]; and `pkt4-processing-failed` and `pkt6-processing-failed` when the packet was dropped due to unexpected exceptions in the Kea code [#4133]. 4. **Bug fixes**: We added unified newline handling of the password-file directive in `kea` and the `auth-password-file` command-line argument in `kea-shell` [#4012]. We fixed a problem in the flex-id hook that caused the expression to be effectively always empty [#4181]. We corrected an issue that was causing an HA peer to not restart its dedicated listener after handling a config-test command, in both `kea-dhcp4` and `kea-dhcp6` [#4145]. We fixed potential memory corruption in MySQL handling [#4021]. We fixed a problem with `kea-admin` on MySQL 9.4.0 [#4119]. We fixed an unlikely race condition at LFC startup [#4090]. 5. **Testing**: We fixed an instability in one FLQ unit test [#4163]. Log tests are now marked as part of the shell suite [#4151]. 6. **Build improvements**: We added shadowing detection for gcc and clang [#3451]. A missing header `eval/location.hh` is now part of the installation [#4150]. We fixed compilation errors for LLVM libc++ 21 [4100]. The `meson.sh` build script now uses Meson 1.9.1 [#4139]. The value of the `-j` argument in `hammer.py` is now passed to meson compile [#4166]. The locale is now restricted to avoid generating an unnecessary epsilon in the grammar [#4082]. 7. **Documentation**: We corrected a mistake in limit hook messages [#4135]. We fixed incorrect documentation about host reservations and basic access control [#2871]. We fixed broken links mainly pointing to design documents in the ARM and the developer's guide [#4138]. We addressed a small problem in the ping check hook section of the ARM [#4106]. We updated the KB article on using Kea packages to reflect the new hook layout [#3776]. ## Incompatible Changes There are no incompatible changes. ## License This version of Kea is released under the Mozilla Public License, version 2.0. https://www.mozilla.org/en-US/MPL/2.0 Some Kea hook libraries are provided under the MPL 2.0; others are licensed with the [Kea Hooks Basic Commercial End User License](https://www.isc.org/kea-premium-license/). The source for each hook library includes the applicable license. ## Download Pre-built ISC packages for current versions of the most popular Linux operating systems are available at: https://cloudsmith.io/~isc/repos/ Pre-built Docker images, as well as Docker files, are available. For details, see: https://gitlab.isc.org/isc-projects/kea-docker The Kea source and PGP signature for this release may be downloaded from: https://www.isc.org/download The signature was generated with the ISC code-signing key, which is available at: https://www.isc.org/pgpkey ISC provides detailed documentation, including installation instructions and usage tutorials, in the Kea Administrator Reference Manual. Documentation is included with the installation or at https://kea.readthedocs.io/en/latest/index.html in HTML, PDF, or EPUB formats. ISC maintains a public open source code tree, wiki, issue tracking system, milestone planner, and roadmap at https://gitlab.isc.org/isc-projects/kea. Limitations and known issues with this release can be found at https://gitlab.isc.org/isc-projects/kea/-/wikis/known-issues-list. We ask users of this software to please let us know how it worked for you and what operating system you tested on. Feel free to share your feedback on the Kea Users mailing list (https://lists.isc.org/mailman/listinfo/kea-users). We would also like to hear whether the documentation is adequate and accurate. Please open tickets in the Kea GitLab project for bugs, documentation omissions and errors, and enhancement requests. We want to hear from you even if everything worked. ## Support Professional support for Kea is available from ISC. We encourage all professional users to consider this option; Kea maintenance is funded with support subscriptions. For more information on ISC's Kea software support, see https://www.isc.org/support/. Free best-effort support is provided by our user community via a mailing list. Information on all public email lists is available at https://www.isc.org/community/mailing-list. If you have any comments or questions about working with Kea, please share them to the Kea Users list (https://lists.isc.org/mailman/listinfo/kea-users). Bugs and feature requests may be submitted via GitLab at https://gitlab.isc.org/isc-projects/kea/-/issues. ## Changes The following summarizes the changes since the previous release. 2412. [build] andrei The library version numbers have been bumped up for the Kea 3.1.3 development release. (Gitlab #4175) 2411. [sec] tmark When a hostname or FQDN received from a client is reduced to an empty string by hostname sanitizing, kea-dhcp4 and kea-dhcp6 will now drop the option. CVE:2025-11232 (Gitlab #4142) 2410. [build] andrei -Wshadow was added to the compiler flags and its warnings addressed. (Gitlab #3451) 2409. [build] andrei Kea now builds with Clang 21. Thanks to Khem Raj for reporting the problem and suggesting a fix. (Gitlab #4100) 2408. [bug] andrei Fixed a bug introduced in flex-id in 3.1.2 which caused the expression to always be empty even when a value was configured under "identifier-expression". (Gitlab #4181) 2407. [bug] tmark Corrected an issue that was causing an HA peer to not restart its dedicated listener after handling a config-test command. Applies to both kea-dhcp4 and kea-dhcp6. (Gitlab #4145) 2406. [bug] razvan Removed logging an error in ping check hook library if using lease cache threshold. (Gitlab #4129) 2405. [bug] razvan, liyunqing_kylin Fixed a data race in ping-check hooks library. Thanks to liyunqing_kylin for reporting and testing the fix for this issue. (Gitlab #4164) 2404. [bug] razvan, liyunqing_kylin Fixed deadlock in ping-check hooks library. Thanks to liyunqing_kylin for reporting and providing a patch. (Gitlab #4140) --- Thank you again to everyone who assisted us in making this release possible. We look forward to receiving your feedback.