CVE-2024-37370 affects MIT Kerberos 5 (krb5) versions before 1.21.3. The vulnerability involves an attacker modifying the plaintext Extra Count field within a confidential GSS krb5 wrap token. This alteration causes the token, once unwrapped by the application, to appear truncated. The issue relates to improper validation or handling of the Extra Count field in the token structure. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. There is no vendor advisory or patch link provided in the data, so patch status is not confirmed.

An attacker can manipulate the Extra Count field in a GSS krb5 wrap token to cause the application to receive a truncated token. This may lead to confidentiality concerns as the token is confidential and altered. However, the vulnerability does not affect integrity or availability. No known exploits are reported, so active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigations are provided in the available data.