Red Hat Product Security issued an advisory for krb5 in Red Hat Enterprise Linux 10 addressing two denial of service vulnerabilities: CVE-2026-40356 involves an integer underflow and out-of-bounds read, and CVE-2026-40355 involves a NULL pointer dereference in the NegoEx mechanism. Both vulnerabilities could cause denial of service conditions. The advisory provides updated krb5 packages to remediate these issues. No CVSS scores are provided in the advisory, but the impact is rated as Important by Red Hat. The advisory includes detailed package updates for multiple architectures and variants of Red Hat Enterprise Linux 10.

Successful exploitation of these vulnerabilities could cause denial of service by crashing or destabilizing the krb5 service, potentially interrupting network authentication processes that rely on Kerberos. There is no indication of code execution or privilege escalation. No known exploits are reported in the wild at this time.

Red Hat has released updated krb5 packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the official Red Hat security update RHSA-2026:19145 promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patch.