# Kea 3.3.0 Release Notes, July 29, 2026 Welcome to Kea 3.3.0, a release of the 3.3 development series. As with any other development release, use this with caution: development releases are not recommended for production use. Kea is a DHCP implementation developed by Internet Systems Consortium (ISC) that features DHCPv4 and DHCPv6 servers with DNS update and a REST API; optional database support (MySQL and PostgreSQL); optional RADIUS, YANG/NETCONF, and Kerberos GSS-TSIG support; and much more. Kea provides extensive management capabilities, including but not limited to: TLS support, Role-Based Access Control, run-time configuration monitoring and updates via a REST API, host reservations, and client classification. The text below references issue numbers. For more details, visit the Kea GitLab page at https://gitlab.isc.org/isc-projects/kea/-/issues. For details about Docker issues, visit the page at https://gitlab.isc.org/isc-projects/kea-docker/-/issues/. For details about packaging, visit the page at https://gitlab.isc.org/isc-projects/kea-packaging/-/issues/. The following bug fixes and features have been implemented since the previous release: 1. **AI/LLM bug fixes**: We fixed a problem where the `assigned-addresses` statistic incorrectly handled declined leases. When used together with the Limits hook, this might have caused unncessary throttling. [#4555]. Both `kea-dhcp4` and `kea-dhcp6` now log and drop host names and FQDNs when host-name sanitization results in embedded empty labels. [#4557]. We fixed the length of FQDN data fields when parsing custom options. [#4567]. We fixed incorrect handling of double DHCPv4 DHCPRELEASEs when the lease affinity feature was enabled, which could lead to incorrect assigned statistics. [#4547]. We corrected the Bulk Lease Query processing; it now returns an error on a bad `dhcp-client-identifier` option. [#4549]. The parsing of DHCPv6 relayed messages is now stricter: truncated RELAY-FORW and RELAY-REPLY headers cause the whole message to be dropped. [#4560]. Lease query for leases with an empty hardware address are now forbidden. [#4578]. The parsing of the the `iaprefix` option is now stricter: now it refuses prefix length values that are too large. We extended the `lenient-option-parsing` compatibility flag to replace such large values by 128, the maximum allowed [#4545]. Kea no longer ignores the subnet's `client-classes` guards when selecting a subnet for a DHCPv4-over-DHCPv6 query. [#4556]. We changed the Forensic Logging hook library to generate a legal log entry using the default log expression, when a custom log expression results in an evaluation error. Previously, the library would emit an error but not generate a legal log entry. [#4563]. Kea now disallows DHCPv4 DHCPLEASEQUERY queries sent using DHCPv4-over-DHCPv6, as they can bypass the sender access control. [#4531]. We improved handling of special characters in values written to the memfile lease database. [#4393, #4521]. We thank Qifan Zhang from Palo Alto Networks for reporting all of the issues above. 2. We also investigated several other LLM-reported issues [#4564,#4546,#4558] and determined the behavior is intentional or there was nothing specific to fix. 3. **Spurious warning removed**: We removed spurious `DHCP_RECEIVE4_UNKNOWN` and `DHCP_RECEIVE6_UNKNOWN` warnings sent, for instance, when a command is received. This resolves a bug that was introduced in 3.2.0 [#4674]. 4. **Sub-options of RAI vendor sub-option**: We added support for unlimited encapsulation levels in the following evaluated expressions: `option[code0].option[code1]...option[codeX]`, `relay4[code0].option[code1]...option[codeX]`, `relay6[nest].option[code0].option[code1]...option[codeX]`, and `vendor[enterprise-id].option[code0].option[code1]...option[codeX]` [#4146]. 5. **Compatibility**: Unless `lenient-option-parsing` is true, Kea servers now drop packets which contain scalar options whose length exceeds their defined length. For example, some broken clients might send more than 4 bytes when a 4-byte length of IPv4 address is expected. Previously, the servers would attempt to parse the option. This applies to both `kea-dhcp4` and `kea-dhcp6` [#4626]. 6. **Forensic logging hook**: We improved multiple-line log records in forensic log files: continuation lines, i.e. all lines before the last one of the log record, get a hyphen instead a space after the leading timestamp. This feature can be disabled, e.g. for backward compatibility, by setting the new parameter `mark-continuation-lines` to "false" in the hook library configuration. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue [#4523,#4526,#4537]. 7. **Command-line arguments in `keactrl`**: The `keactrl` script can now pass command-line arguments to the servers. An argument can be passed in the configuration file for each server, or globally from the command line for all servers [#4630]. 8. **Flex options hook**: The code has been extended to allow patching query packets, similar to the capability Kea already had for the response packets. This might be useful to sanitize incoming packets sent by slightly broken clients [#2529,#4143]. 9. **RADIUS**: RADIUS accounting now ignores DHCPv4 lease reuses [#4544]. 10. **Hex printing**: The code now uses unified hex printing functions. This change should not be visible to users, but there's a slight chance that some messages printing data in hex might have slightly different formatting [#4587]. 11. **More robust client-class names**: Generated client-class names are now escaped to avoid problematic characters, i.e. not letters, not digits, and not in `!#$%&*+-./:?@^_|~`. The escape character is the percent sign: "%". When a configured client class name contains such a character, a warning is emitted. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue [#2598,#4524]. 12. **IP fragmentation disabled**: IP fragmentation for UDP/IPv4 sockets was disabled [#4597]. 13. **Critical failure handling**: The `kea-dhcp4`, `kea-dhcp6`, and `kea-dhcp-ddns` daemons now exit if the `-F` command-line switch is used and a critical failure is detected when issuing the `config-reload`, `config-set`, or `interface-add` commands. We changed "database reconnect disabled" and "failed" log messages from INFO level to either ERROR or FATAL, as appropriate, in the `kea-dhcp4` and `kea-dhcp6` daemons [#4415]. 14. **Bug fixes**: The `max-response-delay` was incorrectly capped at 65535 milliseconds [#4680]. We fixed a bug in the way sub-options are encapsulated for special option spaces, to allow multiple suboptions with the same code point. It should now be possible to send multiple IPv6 NTP servers [#4496]. The `kea-lfc` process no longer removes values on the `hwtype` and `hwaddr_source` columns from v6 lease files, when the lease is not identified through a hardware address (`hwaddr` column). This change allows `kea-admin lease-upload`, which calls `kea-lfc`, to work [#4589]. The broadcast flag in DHCPNAK responses to relayed DHCPREQUEST queries is now properly set. Thank you to Florian Krieger from Frauscher Sensor Technology Group GmbH for reporting the issue [#4424]. We improved parameter checking in the lease commands [#2260]. We updated the Content-Length header when a response is edited by the RBAC hook library [#3743]. ## Incompatible Changes The following incompatible changes were introduced: 1. The parameter `hosts-database` is deprecated; `hosts-databases` should be used instead. The old name is still accepted with a warning, but future Kea versions will stop accepting it [#4309]. 2. Kea is now stricter in parsing broken messages. Kea now drops packets which contain scalar options whose length exceeds their defined length. This can be avoided by setting `lenient-option-parsing` to "true" [#4626]. Another change is that truncated RELAY-FORW messages are now unconditionally dropped [#4560]. The code is now stricter in checking prefix lengths in incoming options. Incorrect values of prefix length greater than 128 are forbidden. If `lenient-option-parsing` is enabled, the too-large values are now sanitized to 128 [#4545]. 3. The Forensic Logging hook now prints a hyphen if there are new lines to be printed. This prevents unlikely cases where a malicious user could send a crafted packet that would trigger forensic logging to generate multiple lines, trying to spoof legitimate log files. If the extra hyphens are not desired, the old behavior can be restored by setting `mark-continuation-lines` to "false" [#4526]. 4. IP fragmentation for outgoing packets for UDP/IPv4 sockets was disabled. This should not make any impact in principle, but could possibly affect users who use links with unusually low MTU [#4597]. ## License This version of Kea is released under the Mozilla Public License, version 2.0. https://www.mozilla.org/en-US/MPL/2.0 Some Kea hook libraries are provided under the MPL 2.0; others are licensed with the [Kea Hooks Basic Commercial End User License](https://www.isc.org/kea-premium-license/). The source for each hook library includes the applicable license. ## Download Pre-built ISC packages for current versions of the most popular Linux operating systems are available at: https://cloudsmith.io/\~isc/repos/ Pre-built Docker images, as well as Docker files, are available. For details, see: https://gitlab.isc.org/isc-projects/kea-docker The Kea source and PGP signature for this release may be downloaded from: https://www.isc.org/download The signature was generated with the ISC code-signing key, which is available at: https://www.isc.org/pgpkey ISC provides detailed documentation, including installation instructions and usage tutorials, in the Kea Administrator Reference Manual. Documentation is included with the installation or at https://kea.readthedocs.io/en/latest/index.html in HTML, PDF, or EPUB formats. ISC maintains a public open source code tree, wiki, issue tracking system, milestone planner, and roadmap at https://gitlab.isc.org/isc-projects/kea. Limitations and known issues with this release can be found at https://gitlab.isc.org/isc-projects/kea/-/wikis/known-issues-list. We ask users of this software to please let us know how it worked for you and what operating system you tested on. Feel free to share your feedback on the Kea Users mailing list (https://lists.isc.org/mailman/listinfo/kea-users). We would also like to hear whether the documentation is adequate and accurate. Please open tickets in the Kea GitLab project for bugs, documentation omissions and errors, and enhancement requests. We want to hear from you even if everything worked. ## Support Professional support for Kea is available from ISC. We encourage all professional users to consider this option; Kea maintenance is funded with support subscriptions. For more information on ISC's Kea software support, see https://www.isc.org/support/. Free best-effort support is provided by our user community via a mailing list. Information on all public email lists is available at https://www.isc.org/community/mailing-list. If you have any comments or questions about working with Kea, please share them to the Kea Users list (https://lists.isc.org/mailman/listinfo/kea-users). Bugs and feature requests may be submitted via GitLab at https://gitlab.isc.org/isc-projects/kea/-/issues. ## Changes The following summarizes the changes since the previous release. 2523. [func] fdupont RADIUS accounting now ignores DHCPv4 lease reuses. (Gitlab #4544) 2522. [func] fdupont Extended the flex-option hook library with two new per option parameters: the 'source' parameter allows to use the response packet for expression evaluation, the 'destination' parameter allows to apply option modification on an incoming query after unpacking. (Gitlab #4143) 2521. [bug] mgodzina Fixed HA configuration parser expecting a value no bigger than 65535 in max-response-delay, heartbeat-delay and max-ack-delay. (Gitlab #4680) 2520. [func] fdupont Changed the way sub-options are encapsulated for special option spaces to allow multiple suboptions with the same code point. Currently only the "v6-ntp-server-suboptions" space of the DHCPv6 "ntp-server" is special but if this feature is useful for other spaces it can be made configurable. (Gitlab #4496) 2519. [bug] tmark Kea now logs and drops host names and FQDNs when host name sanitization results in embedded empty labels (e.g. "aaa..bbb.com"). Applies to both kea-dhcp4 and kea-dhcp6. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue. (Gitlab #4557) 2518. [func] fdupont The parameter 'hosts-database' is deprecated. 'hosts-databases' should be used instead. (Gitlab #4309) 2517. [bug] andrei kea-lfc no longer removes values on the hwtype and hwaddr_source columns from v6 lease files when the lease is not identified through a hardware address (hwaddr column). This change allows "kea-admin lease-upload" which calls kea-lfc, to work. (Gitlab #4589) 2516. [bug] fdupont Fixed the length of FQDN data fields when parsing custom options. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue. (Gitlab #4567) 2515. [bug] fdupont Set the broadcast flag in DHCPNAK responses to relayed DHCPREQUEST queries as required by RFC 2131 4.3.2. Thank you to Florian Krieger from Frauscher Sensor Technology Group GmbH for reporting the issue. (Gitlab #4424) 2514. [func] fdupont Improved parameter checking of lease commands. (Gitlab #2260) 2513. [bug] fdupont Fixed incorrect handling of double DHCPv4 DHCPRELEASE when the lease affinity feature is enabled, e.g. leading to incorrect assigned statistics. (Gitlab #4547) 2512. [bug] fdupont Removed spurious DHCP_RECEIVE4_UNKNOWN and DHCP_RECEIVE6_UNKNOWN warnings sent for instance when a command is received. This bug was introduced in 3.2.0 release. (Gitlab #4674) 2511. [bug] fdupont Corrected Bulk Lease Query processing e.g. now return an error on bad dhcp-client-identifier option. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue. (Gitlab #4549) 2510. [func] mgodzina Keactrl can now pass command line arguments to the servers. Argument can be passed in the configuration file for each server or globally from the command line for all servers. (Gitlab #4630) 2509. [bug] fdupont Made parsing of DHCPv6 relayed messages stricter: now truncated RELAY-FORW and RELAY-REPLY headers cause the whole message to be dropped. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue. (Gitlab #4560) 2508. [func]* tmark Unless "lenient-option-parsing" is true, Kea servers will now drop packets which contain scalar options whose length exceeds their defined length. Prior to this the servers would attempt to parse the option. Applies to both kea-dhcp4 and kea-dhcp6. (Gitlab #4626) 2507. [func] fdupont Disallow lease query of leases with an empty hardware address. (Gitlab #4578) 2506. [func] fdupont Made the parsing of the the iaprefix option stricter: now it refuses too big prefix length values. Extended the "lenient-option-parsing" compatibility flag to replace such too big values by 128, the maximal one. (Gitlab #4545) 2505. [func] fdupont No longer ignore subnet client-classes guards when selecting a subnet for a DHCPv4-over-DHCPv6 query. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue. (Gitlab #4556) 2504. [func]* fdupont Improved multiple line log records in forensic log files: continuation lines, i.e. all lines before the last one of the log record, get a hyphen instead a space after the leading timestamp. This feature can be disabled e.g. for backward compatibility by setting the new parameter "mark-continuation-lines" to false in the hook library configuration. (Gitlab #4526) 2503. [func]* fdupont Generated client class names are now escaped to avoid problematic characters i.e. not letter, not digit and not in '!#$%&*+-./:?@^_|~'. The escape character is the percent sign '%'. When a configured client class name contains such character a warning is emitted. (Gitlab #2598) 2502. [func] fdupont Disable IP fragmentation for UDP/IPv4 sockets. (Gitlab #4597) 2501. [func] tmark Changed legal log hook library to generate a legal log entry using the default log expression when a custom log expression results in an evaluation error. Prior to this the library would emit an error but not generate a legal log entry. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue. (Gitlab #4563) 2500. [func] fdupont Disallow DHCPv4 DHCPLEASEQUERY queries sent using DHCPv4-over-DHCPv6 as they can bypass the sender access control. Thank you to Qifan Zhang from Palo Alto Networks for reporting the issue. (Gitlab #4531) 2499. [bug] tmark Improved handling of special characters in values written to memfile lease database. (Gitlab #4393) 2498. [func] razvan The kea-dhcp4, kea-dhcp6 or kea-dhcp-ddns daemons now exit if the '-F' command line parameter is used and a critical failure is detected when issuing "config-reload", "config-set" or "interface-add" commands. Changed database reconnect disabled and failed log messages from info to either ERROR or FATAL as appropriate in kea-dhcp4 and kea-dhcp6 daemons. (Gitlab #4415) Thank you again to everyone who assisted us in making this release possible. We look forward to receiving your feedback.