Skip to main content

MIT Kerberos 5 CVE-2026-40356

| EUVDEUVD-2026-25993 HIGH
Integer Underflow (CWE-191)
2026-04-28 mitre
Buffer Overflow Integer Overflow Kerberos 5 Mit
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach GSS/SPNEGO acceptor over network
  2. Delivery
    Send crafted NegoEx token
  3. Exploit
    Trigger integer underflow in parse_message
  4. Execution
    Out-of-bounds read in negoex parser
  5. Impact
    Acceptor process terminates (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-191
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
Exploitation Conditions

Exploitation requires the target host to have a NegoEx mechanism registered in /etc/gss/mech AND an application/service that calls gss_accept_sec_context() on attacker-reachable input - this is the concrete, non-default prerequisite stated in the description. Given AV:N/AC:L/PR:N/UI:N, no authentication and no user interaction are needed once that condition holds, and the attacker only needs network reachability to the GSS acceptor. The primary limiting factor is the NegoEx registration requirement: hosts without a NegoEx entry in /etc/gss/mech are not on the vulnerable code path. Impact is limited to availability (process termination) - there is no confidentiality or integrity loss and no code execution indicated.
Impact

Signals are consistent and point to a moderate, availability-only issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects unauthenticated remote reachability, but confidentiality and integrity are unaffected - the realistic outcome is a process crash/DoS, matching CWE-191 and the 'possibly causing the process to terminate' language. EPSS is very low (0.07%, 22nd percentile) and CISA SSVC rates Exploitation: none, Automatable: no, Technical Impact: partial, with no KEV listing and no public exploit. A key nuance the raw 7.5 hides: exploitation requires the target to have a NegoEx mechanism registered in /etc/gss/mech, a non-default deployment condition, so the effective attack surface is narrower than 'any krb5 host.' Net: patch on a normal cycle - it is a genuine unauthenticated DoS but not a widespread, automatable, or code-execution threat.
Exploit ScenarioDerived

An attacker who can reach a network service that accepts GSS-API/SPNEGO tokens on a host with a NegoEx mechanism registered sends a single crafted NegoEx message with manipulated length fields during context acceptance. The underflow in parse_message() causes an out-of-bounds read that crashes the acceptor process, denying service to legitimate clients; no authentication or user interaction is required (PR:N/UI:N), though no public POC has been identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 08, 2026

Remote denial of service in MIT Kerberos 5 (krb5) before 1.22.3 allows an unauthenticated network attacker to crash any application that calls gss_accept_sec_context() on a host where a NegoEx mechanism is registered in /etc/gss/mech. A crafted NegoEx token triggers an integer underflow leading to an out-of-bounds read in parse_message(), terminating the GSS-API acceptor process. No public exploit is identified at time of analysis, EPSS risk is low (0.07%), and CISA SSVC scores exploitation as 'none'.

Earlier versions of this analysis (2)
v2 Jul 08, 2026 - 12:59 cvss changed CVSS 7.5

Remote denial-of-service in MIT Kerberos 5 (krb5) versions 1.18 through 1.22.2 allows an unauthenticated network attacker to crash any application that calls gss_accept_sec_context() on a host where a NegoEx mechanism is registered in /etc/gss/mech. A crafted NegoEx token triggers an integer underflow leading to an out-of-bounds read in parse_message(), typically terminating the acceptor process. No public exploit identified at time of analysis; EPSS is low (0.07%) and CISA SSVC records no known exploitation.

v1 Apr 28, 2026 - 06:45 CVSS 5.9

Integer underflow in MIT Kerberos 5 before version 1.22.3 allows unauthenticated remote attackers to trigger an out-of-bounds read via crafted NegoEx mechanism messages processed by gss_accept_sec_context(), resulting in denial of service through process termination. The vulnerability requires NegoEx to be registered in the system's GSS mechanism configuration (/etc/gss/mech), limiting exposure in default deployments but affecting Kerberos-enabled authentication services where this mechanism is explicitly enabled.

RemediationAI

Vendor-released patch: 1.22.3 - upgrade MIT Kerberos 5 to 1.22.3 or later, or apply your distribution's fixed package (Red Hat: RHSA-2026:12220 at https://access.redhat.com/errata/RHSA-2026:12220; upstream advisories at https://web.mit.edu/kerberos/advisories/). The fix is upstream commit 2e75f0d9362fb979f5fc92829431a590a130929f, which adds a lower-bound check on header_len in parse_message() and a NULL check in parse_nego_message(). Where immediate patching is not possible, a targeted compensating control is to remove or comment out any NegoEx mechanism entry in /etc/gss/mech so the vulnerable parse path is not reachable - the trade-off is loss of NegoEx-based negotiation (e.g. PKU2U/certificate mechanisms) for GSS acceptors, which may break authentication flows that depend on it. Network-restricting exposure of the affected acceptor service reduces reachability but does not remove the underflow.

Affected VersionsENISA

Kerberos 5 1.18 <1.22.3

Affected Packages

euvd kerberos_5 fix: 1.22.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the SPNEGO/NegoEx handling of the GSS-API library (src/lib/gssapi/spnego/negoex_util.c). NegoEx is the extended negotiation protocol layered under SPNEGO used to negotiate modern mechanisms (e.g. PKU2U/certificate-based auth) during gss_accept_sec_context(). During message parsing, parse_message() computes header and message lengths from attacker-supplied token fields; a missing lower-bound check on header_len relative to the parsed pointer offset (in->ptr - msg_base) allows the length arithmetic to wrap (CWE-191, integer underflow/wraparound), producing a bogus large size that drives an out-of-bounds read. This code path is only reachable when a NegoEx mechanism is actually registered in the system GSS mechanism configuration file /etc/gss/mech, so builds without such a mechanism registered are not on the vulnerable path.

Know when Kerberos 5 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Unauthenticated remote token causes a crash with no auth or interaction (PR:N/UI:N, A:H only); the NegoEx-registration prerequisite is a deployment condition, not attacker complexity, so AC:L and no C/I impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.9 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 08, 2026 - 13:00 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 08, 2026 - 12:59 vuln.today
v2 - CVSS changed
Severity Changed
Jul 08, 2026 - 12:52 NVD
MEDIUM HIGH
CVSS changed
Jul 08, 2026 - 12:52 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Patch released
Apr 28, 2026 - 20:11 nvd
Patch available
Patch available
Apr 28, 2026 - 08:01 EUVD
CVE Published
Apr 28, 2026 - 00:00 nvd
MEDIUM 5.9

DescriptionNVD

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.

Executive ViewAI

Why It Matters

MIT Kerberos 5 (krb5) versions before 1.22.3 are vulnerable to remote denial of service that can crash Kerberos authentication acceptor services on hosts with NegoEx mechanism enabled. An unauthenticated network attacker can trigger this vulnerability, potentially disrupting authentication for systems dependent on Kerberos infrastructure. The immediate organizational risk is manageable-no public exploit code exists and exploitation probability is assessed as low-but patching is required for systems in compliance-sensitive or high-availability environments.

Business Impact: Medium
Compensating Controls

Vendor-released patch: MIT Kerberos 5 version 1.22.3 and later. As a temporary mitigation prior to patching, disable NegoEx mechanism registration in /etc/gss/mech on Kerberos acceptor hosts to prevent exploitation vector until patches can be deployed.

Threat Intelligence Overview

EPSS Score
0.1%
Top 78% exploitable
Prevalence
High
krb5 ships in most Linux/enterprise Kerberos deployments; NegoEx config non-default
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Medium
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

More in Kerberos 5

View all
CVE-2022-42898 HIGH POC
8.8 Dec 25

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to r
CVE-2024-26461 HIGH POC
7.5 Feb 29

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. Rated high se
CVE-2022-39028 HIGH POC
7.5 Aug 30

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference v
CVE-2014-4345 HIGH
8.5 Aug 14

Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP

CVE-2017-15088 CRITICAL
9.8 Nov 23

plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name
CVE-2014-5352 CRITICAL
9.0 Feb 19

The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in

CVE-2014-9421 CRITICAL
9.0 Feb 19

The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x t
CVE-2017-11462 CRITICAL
9.8 Sep 13

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving
CVE-2012-1014 CRITICAL
9.0 Aug 06

The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does

CVE-2024-37371 CRITICAL
9.1 Jun 28

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling
CVE-2021-36222 HIGH
7.5 Jul 22

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.
CVE-2012-1015 CRITICAL
9.3 Aug 06

The kdc_handle_protected_negotiation function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x, 1

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:12220 ADVISORY https://ubuntu.com/security/notices/USN-8585-1 ADVISORY https://vuldb.com/vuln/359928 REF https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html REF https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f REF https://web.mit.edu/kerberos/advisories/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy