CVE-2026-91926: Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair entries in ntlm challenge
A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AVPAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AVPAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.
Other sources
gss-ntlmssp (gssapi/gss-ntlmssp) contains a memory leak in the NTLM CHALLENGE target-info parsing on the client (initiator) path. The function ntlmdecodeavpairu16lstr() in src/ntlm.c (line 444) allocates a buffer via malloc and assigns it to str (line 464) without freeing any previous value. The caller ntlmdecodetargetinfo() (line 637) iterates over AVPAIRs in a while loop and decodes each string-valued AVPAIR (MSVAVNBCOMPUTERNAME, MSVAVNBDOMAINNAME, MSVAVDNSCOMPUTERNAME, MSVAVDNSDOMAINNAME, MSVAVDNSTREENAME, MSVAVTARGETNAME) into local variables. If a CHALLENGE message contains a duplicated string-valued AVPAIR ID, the second call overwrites the local pointer without freeing the first allocation. The done: cleanup only frees the last value held. The acceptor path (gsssecctx.c:843) passes NULL for all six string out-parameters, so the leak does not fire server-side. The initiator path is reachable via ntlmprocesstargetinfo() (src/ntlm.c:765), called from gssntlmcliauth() in src/gssauth.c:85, which passes all six string parameters non-NULL. The unguarded allocation predates the February 2023 security batch (GHSL-2023-011/012/013) and was not caught because oss-fuzz drives the acceptor entry point which never runs the string decode. By inspection, all released versions are affected. Reported by Chase Bevan-Thomas (cbev0x), independent security researcher. No upstream fix available at time of report. PSIRT Ticket: PSIRTSUPT-23614. Verified via static analysis in Kaiden sandbox.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected path is the gss-ntlmssp client (initiator) path while it parses an NTLM CHALLENGE message. Systems acting only as the NTLM server are not identified as affected by the provided information.
What does an attacker need to do to trigger the leak?
A malicious server, or a man-in-the-middle server, must provide an NTLM CHALLENGE containing duplicated string-valued AV_PAIR entries. Each duplicate causes the parser to replace a stored string allocation without freeing the earlier allocation.
What is the practical impact of successful exploitation?
Repeated crafted challenges can gradually exhaust memory on the client during NTLM authentication, resulting in denial of service. The provided severity vector indicates no confidentiality or integrity impact.