Threat database

MIT Kerberos 5 (krb5) versions up to 1.22.2 contain a NULL pointer dereference vulnerability in the make_cred_list() function within rd_cred.c. This flaw allows authenticated Kerberos clients to cause a denial of service by crashing services that accept GSS-API security contexts. The issue arises when attackers send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context(), leading to a service crash.

MIT krb5 versions up to 1.22.2 have a NULL pointer dereference vulnerability in the KDC component's get_pac_princ_with_realm() function. This flaw occurs when processing malformed client names in S4U2Proxy requests from a malicious or compromised cross-realm trusted KDC, potentially causing the krb5kdc service to crash and deny authentication.

CVE-2026-40356 is an integer underflow vulnerability in MIT Kerberos 5 versions before 1.22.3. It occurs when gss_accept_sec_context() is called on a system with a NegoEx mechanism registered, causing an out-of-bounds read. An unauthenticated remote attacker can trigger this, potentially causing the affected process to terminate unexpectedly. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.