This vulnerability in MIT Kerberos 5 (krb5) versions prior to 1.22.3 is caused by a NULL pointer dereference in the function parse_nego_message. It occurs when gss_accept_sec_context() is called on a system that has a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can exploit this to cause the process to crash, leading to denial of service. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by crashing the affected process through a NULL pointer dereference. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to services using gss_accept_sec_context() or disabling the NegoEx mechanism if feasible to reduce exposure.