Internet Systems Consortium, Inc. reports:
To trigger the issue, three configuration parameters
must have specific settings: "hostname-char-set" must be
left at the default setting, which is "[^A-Za-z0-9.-]";
"hostname-char-replacement" must be empty (the default);
and "ddns-qualifying-suffix" must NOT be empty (the default is empty).
DDNS updates do not need to be enabled for this issue to manifest.
A client that sends certain option content would then
cause kea-dhcp4 to exit unexpectedly.
This addresses CVE-2025-11232 [#4142, #4155].