# Kea 3.0.4 Maintenance Release Notes, July 29, 2026 Welcome to Kea 3.0.4, a maintenance release of the stable 3.0 series. This supersedes the previous release, version 3.0.3. Kea is a DHCP implementation developed by Internet Systems Consortium (ISC) that features DHCPv4 and DHCPv6 servers with DNS update and a REST API; optional database support (MySQL/MariaDB and PostgreSQL); optional RADIUS, Kerberos, YANG/NETCONF, and GSS-TSIG support; and much more. Kea provides extensive management capabilities, including but not limited to: TLS support, Role-Based Access Control, run-time configuration monitoring and updates via a REST API, host reservations, and client classification. The text below references issue numbers. For more details, visit the Kea GitLab page at https://gitlab.isc.org/isc-projects/kea/-/issues. For details about Docker issues, visit the page at https://gitlab.isc.org/isc-projects/kea-docker/-/issues/. For details about packaging, visit the page at https://gitlab.isc.org/isc-projects/kea-packaging/-/issues/. The following changes and bug fixes have been implemented since the previous release: 1. **Bug fix**: We fixed a bug that caused the DHCPv4 server to crash, if expired reservations were used and any hook library had set the SKIP flag to deny address allocation. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue [#4512, #4697]. 2. **Bug fix**: The conversion from JSON double value to string no longer produces an incorrect output when there is only an exponent part [#4493, #4685]. 3. **Bug fix**: The broadcast flag in DHCPNAK responses is now set to relayed DHCPREQUEST queries as required by RFC 2131 4.3.2. Thank you to Florian Krieger from Frauscher Sensor Technology Group GmbH for reporting the issue [#4683, #4424]. 4. **Bug fix**: DHCPv4 DHCPRELEASE is now rejected for leases that are not in the default/assigned state. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue [#4534, #4547]. 5. **Bug fix**: We corrected an issue in `kea-dhcp4` which caused broadcasted client queries to not match subnets restricted to classes assigned during early global host lookups [#4620, #4047]. 6. **Bug fix**: We backported #4049 to fix an issue in `kea-dhcp-ddns`, which caused GSS-TSIG key exchanges to timeout when NCR traffic was intermittent [#4619, #4049]. 7. **Bug fix**: The Kea servers now return a new status ("result" with value 5) for commands which have failed and have partially altered the running configuration. The rollback mechanism was not able to restore the previous configuration [#4612, #4389]. 8. **Bug fix**: We corrected an issue in the ping check hook library that could result in the ICMP socket getting stuck in the read-ready state [#4615, #4221, #4617, #4140]. 9. **Bug fix**: The memfile lease backend now supports the `on-fail` parameter, though without retry. When set to either `stop-retry-exit` or `serve-retry-exit`, the server now exits on unrecoverable write errors. If set to `serve-retry-continue`, the server continues to run but write errors will continue until corrective action is taken. This applies to both `kea-dhcp4` and `kea-dhcp6` [#4614, #4220]. 10. **Bug fix**: We added a check for prefix length in the `ipv6-prefix` option data type [#4613, #4295]. 11. **Bug fix**: Kea now properly handles lease allocation if a client-reserved lease is not available because a hook library has decided to skip the lease [#4611, #4434]. 12. **Bug fix**: Kea now properly handles shutdown of the high-availability listener on hook unload, when under heavy load [#4610, #4448]. 13. **Bug fix**: We corrected an issue that was causing an HA peer to not restart its dedicated listener after handling a config-test command. This applies to both `kea-dhcp4` and `kea-dhcp6` [#4616, #4145]. 14. **Bug fix**: We extended the parser to accept an empty `client-classes` list in Kea server configuration files [#4609, #4453]. 15. **Bug fix**: We backported several changes to support building with Boost version 1.89 and newer [#4677, #4624, #4266, #4410, #4085]. ## Incompatible Changes There are no incompatible changes. ## Known Issues There are no significant known issues. ## Packaging The `Restart=on-failure` directive was added to systemd services, o-x permission on executables was removed, and their ownership was changed to kea:kea (on RPM-based systems) and _kea:_kea (on deb-based systems). ## License This version of Kea is released under the Mozilla Public License, version 2.0. https://www.mozilla.org/en-US/MPL/2.0 Some Kea hook libraries are provided under the MPL 2.0; others are licensed with the [Kea Hooks Basic Commercial End User License](https://www.isc.org/kea-premium-license/). The source for each hook library includes the applicable license. ## Download Pre-built ISC packages for current versions of the most popular Linux operating systems are available at: https://cloudsmith.io/\~isc/repos/ Pre-built Docker images as well as Docker files are available. For details, see: https://gitlab.isc.org/isc-projects/kea-docker The Kea source and PGP signature for this release may be downloaded from: https://www.isc.org/download The signature was generated with the ISC code-signing key, which is available at: https://www.isc.org/pgpkey ISC provides detailed documentation, including installation instructions and usage tutorials, in the Kea Administrator Reference Manual. Documentation is included with the installation or at https://kea.readthedocs.io/en/latest/index.html in HTML, PDF, or EPUB formats. ISC maintains a public open source code tree, wiki, issue tracking system, milestone planner, and roadmap at https://gitlab.isc.org/isc-projects/kea. Limitations and known issues with this release can be found at https://gitlab.isc.org/isc-projects/kea/-/wikis/known-issues-list. We ask users of this software to please let us know how it worked for you and what operating system you tested on. Feel free to share your feedback on the Kea Users mailing list (https://lists.isc.org/mailman/listinfo/kea-users). We would also like to hear whether the documentation is adequate and accurate. Please open tickets in the Kea GitLab project for bugs, documentation omissions and errors, and enhancement requests. We want to hear from you even if everything worked. ## Support Professional support for Kea is available from ISC. We encourage all professional users to consider this option; Kea maintenance is funded with support subscriptions. For more information on ISC's Kea software support, see https://www.isc.org/support/. Free best-effort support is provided by our user community via a mailing list. Information on all public email lists is available at https://www.isc.org/community/mailing-list. If you have any comments or questions about working with Kea, please share them to the Kea Users list (https://lists.isc.org/mailman/listinfo/kea-users). Bugs and feature requests may be submitted via GitLab at https://gitlab.isc.org/isc-projects/kea/-/issues. ## Changes The following summarizes the changes since the previous release: 2404. [bug] fdupont The from JSON double value to string no longer produces an incorrect output when there is only an exponent part. (Gitlab #4685, #4493) 2403. [bug] fdupont Set the broadcast flag in DHCPNAK responses to relayed DHCPREQUEST queries as required by RFC 2131 4.3.2. Thank you to Florian Krieger from Frauscher Sensor Technology Group GmbH for reporting the issue. (Gitlab #4683, #4424) 2402. [bug] tmark,fdupont Reject DHCPv4 DHCPRELEASE for leases that are not in the default / assigned state. (Gitlab #4534, #4547) 2401. [bug] tmark Corrected an issue in kea-dhcp4 which caused broadcasted client queries to fail to match subnets restricted to classes assigned during early global host lookups. (Gitlab #4620, #4047) 2400. [bug] tmark Backport #4049, which fixed an issue in kea-dhcp-ddns which was causing GSS-TSIG key exchanges to timeout when NCR traffic is intermittent. (Gitlab #4619, #4049) 2399. [func] tmark,razvan The kea servers return a new status ("result" with value 5) for commands which have failed and have partially altered the running configuration. The rollback mechanism was not able to restore the previous configuration. (Gitlab #4612, #4389) 2398. [bug] tmark Corrected an issue in the ping-check hook library that could result in the ICMP socket stuck in the read ready state. (Gitlab #4615, #4221) 2397. [func] tmark Memfile lease back end now supports the ``on-fail`` parameter though without retry. When set to either ``stop-retry-exit`` or ``serve-retry-exit`` the server will exit on unrecoverable write errors. If set to ``serve-retry-continue`` the server will continue to run but write errors will continue until corrective action is taken. Applies to both kea-dhcp4 and kea-dhcp6. (Gitlab #4614, #4220) 2396. [bug] fdupont Added check for prefix length in ipv6-prefix option data type. (Gitlab #4613, #4295) 2395. [bug] tmark Corrected an issue that was causing an HA peer to not restart its dedicated listener after handling a config-test command. Applies to both kea-dhcp4 and kea-dhcp6. (Gitlab #4616, #4145) 2394. [func] fdupont Extended the parser to accepted an empty "client-classes" list in Kea server configuration files. (Gitlab #4609, #4453) 2393. [build] tmark Backported several changes to support building with Boost version 1.89 and newer. (Gitlab #4677, #4624, #4266, #4410, #4085) 2392. [bug] razvan Fixed a bug which was causing the dhcpv4 server to crash when reusing expired reservations and hook libraries set the SKIP flag to deny address allocation. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue. (Gitlab #4697, #4512) 2391. [build] razvan The library version numbers have been bumped up for the Kea 3.0.4 stable release. (Gitlab #4684) 2390. [bug] razvan Properly handle lease allocation if client reserved lease is not available because the hook has decided to skip the lease. (Gitlab #4611, #4434) 2389. [bug] razvan Properly handle high availability listener shutdown on hook unload under heavy load. (Gitlab #4610, #4448) Thank you again to everyone who assisted us in making this release possible. We look forward to receiving your feedback.