Krb5
Monthly
Authenticated Kerberos clients can cause a NULL pointer dereference in MIT Kerberos 5 through 1.22.2 by sending a forwarded KRB-CRED message with more tickets than ticket_info entries to a GSS-API acceptor service, resulting in a service crash (denial of service). The vulnerability requires the attacker to hold a valid Kerberos principal and the target to process forwarded credentials via gss_accept_sec_context(); impact is limited to availability with no confidentiality or integrity effect. No public exploit code identified at time of analysis, and a patch is available via upstream commits.
Denial of service in MIT Kerberos KDCs (krb5 through 1.22.2) lets a malicious or compromised cross-realm trusted KDC crash krb5kdc by sending an S4U2Proxy request whose PAC carries a malformed client name, interrupting authentication for the affected realm until the daemon restarts. The root cause is a NULL pointer dereference (CWE-476) in get_pac_princ_with_realm(), which reports success while leaving the client principal NULL for malformed names. Exploitation is gated by a significant prerequisite - the victim realm must have a cross-realm trust and the attacker must control or have compromised the KDC in that trusted foreign realm (PR:H in both the CVSS 4.0 and independently assessed CVSS 3.1 vectors) - so single-realm deployments without trusts are not exposed; no public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
Authenticated Kerberos clients can cause a NULL pointer dereference in MIT Kerberos 5 through 1.22.2 by sending a forwarded KRB-CRED message with more tickets than ticket_info entries to a GSS-API acceptor service, resulting in a service crash (denial of service). The vulnerability requires the attacker to hold a valid Kerberos principal and the target to process forwarded credentials via gss_accept_sec_context(); impact is limited to availability with no confidentiality or integrity effect. No public exploit code identified at time of analysis, and a patch is available via upstream commits.
Denial of service in MIT Kerberos KDCs (krb5 through 1.22.2) lets a malicious or compromised cross-realm trusted KDC crash krb5kdc by sending an S4U2Proxy request whose PAC carries a malformed client name, interrupting authentication for the affected realm until the daemon restarts. The root cause is a NULL pointer dereference (CWE-476) in get_pac_princ_with_realm(), which reports success while leaving the client principal NULL for malformed names. Exploitation is gated by a significant prerequisite - the victim realm must have a cross-realm trust and the attacker must control or have compromised the KDC in that trusted foreign realm (PR:H in both the CVSS 4.0 and independently assessed CVSS 3.1 vectors) - so single-realm deployments without trusts are not exposed; no public exploit was identified at time of analysis and the issue is not listed in CISA KEV.