[kea-announce] Kea 2.6.5, 3.0.3, and 3.1.7 are released

[Suzanne Goldlust]

Internet Systems Consortium is pleased to announce the releases of Kea 2.6.5, 3.0.3, and 3.1.7. Kea 2.6.5 and 3.0.3 are maintenance releases on the existing stable branches, and Kea 3.1.7 is a development release.

Please note that both the stable versions address a vulnerability in Kea: CVE-2026-3608: Stack overflow in Kea daemons; see our published advisory at https://kb.isc.org/docs/cve-2026-3608 . Kea 3.1.7 is not susceptible to this CVE, but development versions are not suitable for production use.

Release notes for Kea 2.6.5 are available at https://downloads.isc.org/isc/kea/2.6.5/Kea-2.6.5-ReleaseNotes.txt

Release notes for Kea 3.0.3 are available at https://downloads.isc.org/isc/kea/3.0.3/Kea-3.0.3-ReleaseNotes.txt

Release notes for Kea 3.1.7 are available at https://downloads.isc.org/isc/kea/3.1.7/Kea-3.1.7-ReleaseNotes.txt

Source tarballs and packages are available from our Cloudsmith repositories at https://cloudsmith.io/~isc/repos/kea-2-6/groups/ for 2.6.5 and at https://cloudsmith.io/~isc/repos/kea-3-0/groups/ for 3.0.3, and at https://cloudsmith.io/~isc/repos/kea-dev/groups/ for 3.1.7. The releases are also available from the ISC download page at https://www.isc.org/download/#Kea.

Maintenance of the Kea 2.4 branch ended with the release of Kea 3.0.0. Please update to the 2.6 or 3.0 versions if you haven't already.

Thank you for using ISC’s software!