Skip to main content

MIT Kerberos 5 CVE-2026-40355

| EUVDEUVD-2026-25981 HIGH
NULL Pointer Dereference (CWE-476)
2026-04-28 mitre
Denial Of Service Null Pointer Dereference Kerberos 5 Mit
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach GSS/SPNEGO acceptor service
  2. Delivery
    Craft malformed NegoEx token
  3. Exploit
    Send in initial context message
  4. Execution
    parse_nego_message dereferences NULL pointer
  5. Impact
    Acceptor process crashes (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target host has a NegoEx mechanism registered in /etc/gss/mech AND runs an application that calls gss_accept_sec_context() on attacker-reachable input - this non-default configuration is the primary limiting factor. When that prerequisite is met, no authentication and no user interaction are needed (PR:N/UI:N per the provided vector); the attacker only needs network reachability to the acceptor to deliver a crafted NegoEx token. Hosts with no NegoEx entry in /etc/gss/mech, or applications that never accept GSS contexts, are not exploitable. Impact is confined to availability (process termination); there is no code execution or data disclosure.
Impact

The available signals are internally consistent and point to a real but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, C:N/I:N) captures an unauthenticated, network-reachable, availability-only impact and scores 7.5. However, EPSS is very low (0.07%, 22nd percentile) and CISA SSVC rates exploitation as 'poc', automatable 'no', technical impact 'partial' - so it is neither mass-exploited nor wormable. Most importantly, exploitation is gated by a non-default prerequisite: a NegoEx mechanism must be registered in /etc/gss/mech, which is uncommon on typical krb5 deployments, so the effective attack surface is far narrower than AV:N/AC:L alone implies. There is no confidentiality or integrity impact - the worst case is a crashed acceptor process. Net assessment: treat as routine patching/hardening rather than an emergency, but prioritize hosts that actually register NegoEx mechanisms and expose GSS acceptors to untrusted networks.
Exploit ScenarioDerived

An attacker able to reach a network service that performs GSS-API/SPNEGO authentication on a host with a NegoEx mechanism registered sends a single crafted NegoEx token in the initial context-establishment message. When the service calls gss_accept_sec_context(), parse_nego_message dereferences a NULL pointer and the process crashes, denying service to all users. No credentials or user interaction are required, but no public POC has been identified and the malformed token must exercise the parser's flawed length handling.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 08, 2026

Remote denial of service in MIT Kerberos 5 (krb5) before 1.22.3 lets an unauthenticated attacker crash any GSS-API acceptor that has a NegoEx mechanism registered in /etc/gss/mech. Sending a malformed NegoEx token to an application that calls gss_accept_sec_context() triggers a NULL pointer dereference in parse_nego_message, terminating the process (CWE-476). No public exploit identified at time of analysis; EPSS is low (0.07%) and CISA SSVC lists exploitation as proof-of-concept only, with technical impact rated partial and not automatable.

Earlier versions of this analysis (2)
v2 Jul 08, 2026 - 12:58 cvss changed CVSS 7.5

Remote denial of service in MIT Kerberos 5 (krb5) versions 1.18 through 1.22.2 lets an unauthenticated attacker crash any GSS-API acceptor by sending a malformed NegoEx token, triggering a NULL pointer dereference in parse_nego_message. Only servers that call gss_accept_sec_context() with a NegoEx mechanism registered in /etc/gss/mech are affected. SSVC indicates proof-of-concept exploit code exists, though EPSS remains very low (0.07%, 22nd percentile) and the flaw is not in CISA KEV.

v1 Apr 28, 2026 - 06:00 CVSS 5.9

NULL pointer dereference in MIT Kerberos 5 before version 1.22.3 allows unauthenticated remote attackers to trigger denial of service by sending specially crafted messages to systems with NegoEx mechanism registered, causing gss_accept_sec_context() to crash during message parsing. The vulnerability requires high attack complexity due to NegoEx mechanism registration dependency but results in service termination with no authentication required.

RemediationAI

Vendor-released patch: upgrade to MIT krb5 1.22.3 or later, which adds the missing NULL check and length-consistency validation to the NegoEx parser (upstream commit https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f). Distribution users should apply their packaged fix - Red Hat customers via RHSA-2026:12220 (https://access.redhat.com/errata/RHSA-2026:12220) - and check https://web.mit.edu/kerberos/advisories/ for other platforms. Where immediate patching is not possible, a targeted compensating control is to remove or comment out the NegoEx mechanism entry in /etc/gss/mech so the vulnerable parse_nego_message path is never reached; the trade-off is loss of NegoEx-based mechanism negotiation for any clients that depend on it. Additionally, restrict network reachability of the affected acceptor service to trusted clients to limit who can deliver a crafted token.

Affected VersionsENISA

Kerberos 5 1.18 <1.22.3

Affected Packages

euvd kerberos_5 fix: 1.22.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the SPNEGO/NegoEx code path of the GSS-API library shipped with MIT krb5 (cpe:2.3:a:mit:kerberos_5). NegoEx is the extended negotiation protocol layered on top of SPNEGO to select modern GSS mechanisms, and it is only reached when an administrator registers a NegoEx-capable mechanism in the /etc/gss/mech plugin configuration. The vendor commit 2e75f0d9 shows parse_nego_message failing to verify that a parsed pointer 'p' is non-NULL before use, and parse_message accepting inconsistent length fields (it was missing the header_len < (in->ptr - msg_base) lower-bound check alongside the header_len/msg_len sanity checks). A crafted token carrying invalid message sizes therefore leaves a NULL pointer that is subsequently dereferenced. This is a classic input-validation gap (CWE-476) on attacker-controlled protocol data that is parsed before authentication completes.

Know when Kerberos 5 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.9 MEDIUM

Unauthenticated network DoS with availability-only impact, but exploitation depends on a non-default NegoEx registration in /etc/gss/mech outside the attacker's control, warranting AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.9 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 08, 2026 - 12:58 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 08, 2026 - 12:58 vuln.today
v2 - CVSS changed
Severity Changed
Jul 08, 2026 - 12:52 NVD
MEDIUM HIGH
CVSS changed
Jul 08, 2026 - 12:52 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Patch released
Apr 28, 2026 - 20:11 nvd
Patch available
Patch available
Apr 28, 2026 - 07:16 EUVD
CVE Published
Apr 28, 2026 - 00:00 nvd
MEDIUM 5.9

DescriptionNVD

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

Executive ViewAI

Why It Matters

MIT Kerberos 5 before version 1.22.3 contains a remote denial-of-service vulnerability allowing unauthenticated attackers to crash GSS-API authentication services via malformed NegoEx tokens. This disrupts organizations' centralized authentication infrastructure and can cascade to dependent applications. Patch 1.22.3 is available and should be prioritized given the criticality of Kerberos to enterprise access control.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 78% exploitable
Prevalence
Ubiquitous
krb5 is the core Kerberos/GSS-API stack in most Linux/Unix environments
Threat Intel
2
1 source
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment CISA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Kerberos 5

View all
CVE-2022-42898 HIGH POC
8.8 Dec 25

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to r
CVE-2024-26461 HIGH POC
7.5 Feb 29

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. Rated high se
CVE-2022-39028 HIGH POC
7.5 Aug 30

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference v
CVE-2014-4345 HIGH
8.5 Aug 14

Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP

CVE-2017-15088 CRITICAL
9.8 Nov 23

plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name
CVE-2014-5352 CRITICAL
9.0 Feb 19

The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in

CVE-2014-9421 CRITICAL
9.0 Feb 19

The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x t
CVE-2017-11462 CRITICAL
9.8 Sep 13

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving
CVE-2012-1014 CRITICAL
9.0 Aug 06

The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does

CVE-2024-37371 CRITICAL
9.1 Jun 28

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling
CVE-2021-36222 HIGH
7.5 Jul 22

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.
CVE-2012-1015 CRITICAL
9.3 Aug 06

The kdc_handle_protected_negotiation function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x, 1

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04 ICSA-26-295-11
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:12220 ADVISORY https://ubuntu.com/security/notices/USN-8585-1 ADVISORY https://vuldb.com/vuln/359921 REF https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f REF https://web.mit.edu/kerberos/advisories/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy