openSUSE Leap 16.0 kea Important Fix Stack Overflow 2026-20452-1

This update for kea fixes the following issues:

Update to 3.0.3:

- CVE-2025-11232: invalid characters cause assert (bsc#1252863).

- CVE-2026-3608: stack overflow via maliciously crafted message (bsc#1260380).

Changelog:

* A large number of bracket pairs in a JSON payload directed to

any endpoint would result in a stack overflow, due to recursive

calls when parsing the JSON. This has been fixed.

(CVE-2026-3608)

[bsc#1260380]

* When a hostname or FQDN received from a client is reduced to an

empty string by hostname sanitizing, kea-dhcp4 and kea-dhcp6

will now drop the option.

(CVE-2025-11232)

[bsc#1252863]

* A null dereference is now no longer possible when configuring

the Control Agent with a socket that lacks the mandatory

socket-name entry.

* UNIX sockets are now created as group-writable.

* Removed logging an error in ping check hook library if using

lease cache treshold.

* Fixed deadlock in ping-check hooks library.

* Fixed a data race in ping-check hooks...