The following versions are supported:

Starting with the Kea 1.7 release, all Kea versions with an odd minor version number are development releases, and become EOL as soon as the following stable release is published.

Limited past EOL support may be available to higher tier customers. Please contact ISC sales, using this form: https://www.isc.org/contact/

To report security vulnerability, please follow this instruction:

https://www.isc.org/reportbug/

Briefly, we prefer confidential issue on gitlab (not github). An issue is much better, because it's easier to get more ISC engineers involved in it, evolve the case as more information is known, update or extra information, etc.

Second best is to send e-mail (possibly encrypted) to kea-security@isc.org.

ISC treats the security of its software products very seriously. This document discusses the evaluation of a defect severity and the process in detail: https://kb.isc.org/docs/aa-00861

The Kea security section of Kea ARM discusses the technical aspects, such as how to properly configure TLS certificates, how to secure Kea deployment and also what the security incident handling process looks like: https://kea.readthedocs.io/en/latest/arm/security.html#kea-security-processes

The Past advisories for Kea can be found on the KB: https://kb.isc.org/docs On the left hand panel, see the Security Advisiories in the Kea DHCP section.