# Kea 3.1.4 Release Notes, November 26, 2025 Welcome to Kea 3.1.4, a maintenance release of the 3.1 development series. As with any other development release, use this with caution: development releases are not recommended for production use. Kea is a DHCP implementation developed by Internet Systems Consortium (ISC) that features DHCPv4 and DHCPv6 servers with DNS update and a REST API; optional database support (MySQL and PostgreSQL); optional RADIUS, YANG/NETCONF, and Kerberos GSS-TSIG support; and much more. Kea provides extensive management capabilities, including but not limited to: TLS support, Role-Based Access Control, run-time configuration monitoring and updates via a REST API, host reservations, and client classification. The text below references issue numbers. For more details, visit the Kea GitLab page at https://gitlab.isc.org/isc-projects/kea/-/issues. For details about Docker issues, visit the page at https://gitlab.isc.org/isc-projects/kea-docker/-/issues/. For details about packaging, visit the page at https://gitlab.isc.org/isc-projects/kea-packaging/-/issues/. The following bug fixes and features have been implemented since the previous release: 1. **Interface and sockets**: Work is underway to improve general socket and interface handling, specifically certain interfaces and sockets, unusual interface types, and so on. The first issue merged deals with updated code for handling closed sockets [#4217, #4141]. Feedback is requested: please do report any observed changes in behavior, especially if you use many interfaces; have a dynamic environment with many interfaces going up and down; dynamically reconfigure Kea to close, open, or reopen sockets; or run your servers with high utilization or overloaded scenarios. 2. **Leasequery access list**: The leasequery access list can now allow whole subnets, not just a single address. This might be useful to grant leasequery capabilities to all routers in a given network, instead of enumerating them one by one [#4190]. 3. **Statistics**: We added `pkt4-not-for-us` and `pkt6-not-for-us` statistics for dropped packets [#4126]. Additional statistics for dropping packets under various conditions were added. Complete documentation was added to the ARM for all statistics included in this and earlier releases [#3140]. 4. **Address registration improvements**: Kea supports the address registration mechanism defined in RFC9686. However, some administrators might prefer not to use this mechanism in their deployments, so the DHCPv6 daemon now supports a global `allow-address-registration` parameter that allows disabling this mechanism. Also, an issue was corrected in which the server was not correctly enforcing a peer address match when ADDR-REG-INFORMs were received via relay [#4161]. 5. **Bug fixes**: A potential data race in ping check was fixed [#4206]. We corrected an issue in the ping check hook library that could result in the ICMP socket getting stuck in the read-ready state [#4221]. A potential crash during shutdown was fixed in the MySQL hook [#4207]. We fixed a bug which made the LFC attempt to use the wrong PID file when Kea was started or reconfigured [#4198]. We fixed a small duplication in the extended version (`-V` command-line switch) handling [#4159]. We fixed a bug with socket names not expanding properly for `kea-netconf` [#3969]. We fixed a memory leak before shutdown of `kea-dhcp-ddns` when using multiple sockets [#4196]. We fixed a bug in the Subnet Commands hook reported by AddressSanitizer [#4205]. 6. **Testing**: An unstable test for the lease file manager running under ThreadSanitizer was fixed [#4165]. We fixed several issues with `meson dist` running tests: YANG shell tests are now run, socket paths are unified, and problems with too-long socket paths are fixed [#4144]. 7. **Documentation**: Several new open source hooks developed by the community were added to the Available Hooks list on the project wiki [#4191, #4210]. We added a note to the Developer's Guide about how hook developers can maintain consistent statistics [#3337]. ## Incompatible Changes There are no incompatible changes. ## License This version of Kea is released under the Mozilla Public License, version 2.0. https://www.mozilla.org/en-US/MPL/2.0 Some Kea hook libraries are provided under the MPL 2.0; others are licensed with the [Kea Hooks Basic Commercial End User License](https://www.isc.org/kea-premium-license/). The source for each hook library includes the applicable license. ## Download Pre-built ISC packages for current versions of the most popular Linux operating systems are available at: https://cloudsmith.io/~isc/repos/ Pre-built Docker images, as well as Docker files, are available. For details, see: https://gitlab.isc.org/isc-projects/kea-docker The Kea source and PGP signature for this release may be downloaded from: https://www.isc.org/download The signature was generated with the ISC code-signing key, which is available at: https://www.isc.org/pgpkey ISC provides detailed documentation, including installation instructions and usage tutorials, in the Kea Administrator Reference Manual. Documentation is included with the installation or at https://kea.readthedocs.io/en/latest/index.html in HTML, PDF, or EPUB formats. ISC maintains a public open source code tree, wiki, issue tracking system, milestone planner, and roadmap at https://gitlab.isc.org/isc-projects/kea. Limitations and known issues with this release can be found at https://gitlab.isc.org/isc-projects/kea/-/wikis/known-issues-list. We ask users of this software to please let us know how it worked for you and what operating system you tested on. Feel free to share your feedback on the Kea Users mailing list (https://lists.isc.org/mailman/listinfo/kea-users). We would also like to hear whether the documentation is adequate and accurate. Please open tickets in the Kea GitLab project for bugs, documentation omissions and errors, and enhancement requests. We want to hear from you even if everything worked. ## Support Professional support for Kea is available from ISC. We encourage all professional users to consider this option; Kea maintenance is funded with support subscriptions. For more information on ISC's Kea software support, see https://www.isc.org/support/. Free best-effort support is provided by our user community via a mailing list. Information on all public email lists is available at https://www.isc.org/community/mailing-list. If you have any comments or questions about working with Kea, please share them to the Kea Users list (https://lists.isc.org/mailman/listinfo/kea-users). Bugs and feature requests may be submitted via GitLab at https://gitlab.isc.org/isc-projects/kea/-/issues. ## Changes The following summarizes the changes since the previous release. 2418. [bug] fdupont, tmark Fixed a bug which made the lfc running check in config set and reload command to use the wrong file. (Gitlab #4198) 2417. [bug] tmark Corrected an issue in the ping-check hook library that could result in the ICMP socket stuck in the read ready state. (Gitlab #4221) 2416. [func] tmark Added a global parameter, "allow-address-registration", to kea-dhcp6. It enables or disables client address registration (see RFC 9686). It also corrects an issue in which the server was not correctly enforcing a peer address match when ADDR-REG-INFORMs are received via relay. (Gitlab #4161) 2415. [func] tmark The lease query hooks configuration parameter, 'requesters', now also accepts address ranges expressed in CIDR format. Prior to this it was restricted to one or more IP addresses. (Gitlab #4190) 2414. [func] fdupont Added "pkt4-queue-full" and "pkt6-queue-full" statistics which are increased when an incoming packet was dropped because it was queued and the queue is full. Added "pkt4-rfc-violation" and "pkt6-rfc-violation" statistics which are increased when an incoming packet has to be dropped according to protocol specifications. Added "pkt4-admin-filtered" and "pkt6-admin-filtered" statistics which are increased when an incoming packet was dropped because the server was configured to do so, e.g. by classifying the query into the DROP class. Added "pkt4-not-for-us" and "pkt6-not-for-us" statistics which are increased when an incoming packet was dropped because it has to be handled by another server. Added "pkt4-processing-failed" and "pkt6-processing-failed" statistics which are increased when an incoming packet was dropped because an unexpected error occurred during processing. Added "pkt4-limit-exceeded" and "pkt6-limit-exceeded" statistics which are increased when an incoming packet was dropped by the limits hook library. (Gitlab #3140, #4157, #4146, #4127, #4126, #4133, #4134) 2413. [sec]* andrei Restrict the path of the UNIX socket to which kea-netconf connects the same way the path is restricted for other servers on creation of UNIX sockets. (Gitlab #3969) --- Thank you again to everyone who assisted us in making this release possible. We look forward to receiving your feedback.