CVE-2026-40356
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In MIT Kerberos 5 (krb5) before 1.22.3, an integer underflow and resultant out-of-bounds read occur if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
Risk Assessment
The risk is a remote denial of service (DoS) without authentication, potentially disrupting services relying on Kerberos.
Recommendation
Immediately upgrade MIT Kerberos 5 to version 1.22.3 or later, which fixes this vulnerability.
Other vulnerabilities in MIT Kerberos 5
See all- CVE-2024-37370High
In MIT Kerberos 5 before version 1.21.3, an attacker can modify the Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
- CVE-2024-37371Critical
In MIT Kerberos 5 before version 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.
- CVE-2026-40355Medium
In MIT Kerberos 5 (krb5) before version 1.22.3, there is a NULL pointer dereference when an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
- CVE-2025-3576Medium
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes.
Original NVD description (English source)
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.