[Kea-users] Kea6 random segmentation fault

Wed Jul 29 21:01:58 UTC 2026

Hi Andreas,

There is not much to go on here.  I don't see anything interesting in
the configuration.  The log messages are not of much help either.  If
you are able to obtain a core file, it is best not to upload it here
in case this is a security issue.  It would be best to create
confidential issue here:
https://gitlab.isc.org/isc-projects/kea/-/work_items (Be sure and
checkmark "Turn on confidentiality" as this could be a security
issue).

Thank you,
Darren Ankney

On Mon, Jul 27, 2026 at 6:20 PM Andreas <ml+dhcp at tibdefender.com> wrote:
>
> Dear Ben,
>
> >   What changed immediately prior?  Any software/firmware updates to
> > Kea or OS or libraries or routers or switches or CPE?  Any changes in
> > configuration?  Were any Kea API commands being performed around when
> > the crash occurred?
> No changes at all, also no updates to Kea or OS nor the network. We
> moved more and more customers from old DHCP solution to Kea, but the
> last move was one day before the segfaults happened. No change to
> configuration since then.
> We do see plenty of these requests coming in:
> ...
> 2026-07-26 12:19:03.798 kea-dhcp6.host-cmds-hooks
> HOST_CMDS_RESERV_GET_PAGE reservation-get-page command called
> (parameters: { "limit": 1000, "source-index": 1, "subnet-id": 5014 })
> 2026-07-26 12:19:03.798 kea-dhcp6.host-cmds-hooks
> HOST_CMDS_RESERV_GET_PAGE_SUCCESS reservation-get-page command success
> (parameters: { "limit": 1000, "source-index": 1, "subnet-id": 5014 })
> 2026-07-26 12:19:03.805 kea-dhcp6.auth HTTP_CLIENT_REQUEST_AUTHORIZED
> received HTTP request authorized for 'kea-api'
> 2026-07-26 12:19:03.805 kea-dhcp6.commands COMMAND_RECEIVED Received
> command 'reservation-get-page'
> 2026-07-26 12:19:03.805 kea-dhcp6.host-cmds-hooks
> HOST_CMDS_RESERV_GET_PAGE reservation-get-page command called
> (parameters: { "limit": 1000, "source-index": 1, "subnet-id": 6031 })
> 2026-07-26 12:19:03.805 kea-dhcp6.host-cmds-hooks
> HOST_CMDS_RESERV_GET_PAGE_SUCCESS reservation-get-page command success
> (parameters: { "limit": 1000, "source-index": 1, "subnet-id": 6031 })
> 2026-07-26 12:19:03.807 kea-dhcp6.auth HTTP_CLIENT_REQUEST_AUTHORIZED
> received HTTP request authorized for 'kea-api'
> 2026-07-26 12:19:03.807 kea-dhcp6.commands COMMAND_RECEIVED Received
> command 'reservation-get-page'
> 2026-07-26 12:19:03.807 kea-dhcp6.host-cmds-hooks
> HOST_CMDS_RESERV_GET_PAGE reservation-get-page command called
> (parameters: { "limit": 1000, "source-index": 1, "subnet-id": 5015 })
> 2026-07-26 12:19:03.807 kea-dhcp6.host-cmds-hooks
> HOST_CMDS_RESERV_GET_PAGE_SUCCESS reservation-get-page command success
> (parameters: { "limit": 1000, "source-index": 1, "subnet-id": 5015 })
> but this stopped at 12:19:03 and the crash was 12:19:21
>
> or this one
>
> 2026-07-24 16:50:41.738 kea-dhcp6.auth HTTP_CLIENT_REQUEST_AUTHORIZED
> received HTTP request authorized for 'kea-api'
> 2026-07-24 16:50:41.738 kea-dhcp6.commands COMMAND_RECEIVED Received
> command 'status-get'
> which is also about 5 seconds before the crash at 16:50:46
>
> >   What distribution and release?  What kernel version?
> Debian 13 with kernel 6.12.85+deb13-amd64
>
> > Please provide the output of "kea-dhcp6 -V" from the server that crashed.
> Both daemons show the same output:
>
> 3.0.3 (3.0.3 (isc20260313155935 deb))
> premium: yes (isc20260313155935 deb)
> linked with:
> - log4cplus 2.0.8
> - OpenSSL 3.5.5 27 Jan 2026
> lease backends:
> - Memfile backend 5.0
>
> >   Please provide a copy the configuration in use at the time of the
> > crash.  Redact passwords and the like, of course.
> Config is attached, hope the level of anonymization is still working for
> you.
>
> >   Have you captured a core dump?  If not, please do so.  If yes, can
> > you please provide a backtrace of all threads?
> Unfortunately there is no core file.  I followed the process mentioned
> in https://kb.isc.org/docs/aa-00340 to make core file creation possible,
> but no crash since then.
>
> After some more digging in the logs we saw that rsyslog was logging rate
> limits since two days, which could be related that we moved more
> customers to kea:
> 2026-07-26T12:18:47.010637+02:00 kea-dhcp-02 rsyslogd:
> rsyslogd[internal_messages]: 2970 messages lost due to rate-limiting
> (500 allowed within 5 seconds)
> 2026-07-26T12:18:53.008681+02:00 kea-dhcp-02 rsyslogd:
> rsyslogd[internal_messages]: 3696 messages lost due to rate-limiting
> (500 allowed within 5 seconds)
> 2026-07-26T12:18:59.004594+02:00 kea-dhcp-02 rsyslogd:
> rsyslogd[internal_messages]: 4096 messages lost due to rate-limiting
> (500 allowed within 5 seconds)
> 2026-07-26T12:19:05.039959+02:00 kea-dhcp-02 rsyslogd:
> rsyslogd[internal_messages]: 3796 messages lost due to rate-limiting
> (500 allowed within 5 seconds)
> 2026-07-26T12:19:11.006562+02:00 kea-dhcp-02 rsyslogd:
> rsyslogd[internal_messages]: 3344 messages lost due to rate-limiting
> (500 allowed within 5 seconds)
> 2026-07-26T12:19:17.031865+02:00 kea-dhcp-02 rsyslogd:
> rsyslogd[internal_messages]: 1898 messages lost due to rate-limiting
> (500 allowed within 5 seconds)
>
> We are forwarding the legal hook messages to rsyslog and then to graylog.
> This was one of the things we disabled on first shot (back to normal log
> file instead syslog destination) to find out the reason, but it didn't
> change anything.
>
>
> BR
> Andreas
>
> Am 27.07.2026 um 19:20 schrieb Ben Scott:
> > On 7/27/26 06:59, Andreas wrote:
> >> since Friday we're experiencing random and unexplainable Segmentation
> >> Faults on kea6-server.
> >
> >   What changed immediately prior?  Any software/firmware updates to
> > Kea or OS or libraries or routers or switches or CPE?  Any changes in
> > configuration?  Were any Kea API commands being performed around when
> > the crash occurred?
> >
> >   What distribution and release?  What kernel version?
> >
> >   Please provide the output of "kea-dhcp6 -V" from the server that
> > crashed.
> >
> >   Please provide a copy the configuration in use at the time of the
> > crash.  Redact passwords and the like, of course.
> >
> >   Have you captured a core dump?  If not, please do so.  If yes, can
> > you please provide a backtrace of all threads?
> >
> >   You can post large text dumps to a site like https://pastebin.com/
> > if that helps.
> >
> >   -- Ben
> >
>
> --
> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
>
> To unsubscribe visit https://lists.isc.org/mailman/listinfo/kea-users.
> Kea-users at lists.isc.org