Red Hat Product Security issued an advisory for two denial of service vulnerabilities in MIT Kerberos 5 (krb5) affecting Red Hat Enterprise Linux 8. CVE-2026-40356 involves an integer underflow and out-of-bounds read, while CVE-2026-40355 involves a NULL pointer dereference in the NegoEx mechanism. Both vulnerabilities can cause denial of service conditions. The advisory references updated krb5 packages that fix these issues. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat.

Successful exploitation of these vulnerabilities could cause denial of service by crashing the krb5 service, potentially disrupting authentication services relying on Kerberos. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported at this time.

Red Hat has released updated krb5 packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:16799 and the referenced article https://access.redhat.com/articles/11258. Patch status is confirmed as an official fix available from Red Hat. No additional mitigation steps are indicated by the vendor.