CVE-2025-59088

HighCVSS 8.6

Published: 12/11/2025(UTC)Updated: 30/06/2026(UTC)Translated: 01/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

Kdcproxy by default queries SRV records in the DNS zone matching the requested realm if no server addresses are defined. An attacker can create SRV records pointing to arbitrary hosts and ports, including loopback or internal IPs, leading to an SSRF vulnerability. This allows probing internal network topology, firewall rules, port scanning, and data exfiltration.

Risk Assessment

The organization is at risk of unauthorized access to internal network infrastructure, potentially leading to network topology discovery, firewall rule testing, and data leakage. Attackers can exploit this to perform port scanning and attacks on internal systems.

Recommendation

Explicitly set the 'use_dns' option to false in the kdcproxy configuration to disable DNS SRV queries. If necessary, define server addresses for each realm in the configuration.

Other vulnerabilities in kdcproxy

CVE-2025-59089Medium
A vulnerability in kdcproxy allows an attacker to perform a DoS attack by sending unbounded data in a KDC response, causing excessive memory and CPU usage. The lack of TCP response length validation and inefficient buffer management can overwhelm the server even with a single request.

Original NVD description (English source)

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.