• New version 2.6.3 (#2368989)
• Fix for: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803
• kea.conf: Remove /tmp/ from socket-name for existing configurations
• kea.conf: Set pseudo-random password for default config to secure fresh install and allow CA startup without user intervention
• kea.conf: Restrict directory permissions
• Sync service files with upstream
• Fix leases ownership when switching from root to kea user (#2324168)

Release Notes:

The new default configuration file, kea-ctrl-agent.conf, introduces an authentication setting, "password-file", which restricts access to the REST API. On Fedora, the kea-api-password file is automatically populated with a pseudo-random password to secure new installations.

For system upgrades, it is strongly recommended to update any custom configurations to restrict access to the REST API.

For more details, including information on CVE fixes and incompatible changes, refer to the upstream release notes:

https://downloads.isc.org/isc/kea/2.6.3/Kea-2.6.3-ReleaseNotes.txt