OESA-2026-4826: gssproxy security update

Q: Who can exploit this issue?

Any local user able to send a request to the gssproxy Unix socket can trigger the crash. The malformed GSSX_INIT_SEC_CONTEXT request does not require authentication.

Q: What is the operational impact of a successful exploit?

The gssproxy daemon crashes and does not restart automatically, creating a persistent denial of service. Services that depend on it, including Kerberized NFS and IdM, may also be affected.

Q: How can administrators determine whether they are affected?

Systems using the openeuler/gssproxy package are in scope. A crash triggered by a GSSX_INIT_SEC_CONTEXT request with an absent target_name field indicates exposure to this vulnerability.

Published Nov 11, 2026

Updated

This is a proxy for GSSAPI which deals with credential handling Security Fix(es):

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.(CVE-2026-116497)

Affected Software

1 affected componentFixes available

openeuler/gssproxy<0.9.2-9.oe2403sp1

0.9.2-9.oe2403sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/gssproxy to a version that resolves this vulnerability.
Fixed in 0.9.2-9.oe2403sp1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:26 PM

Data Sourced

via OSV·12:26 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116497

Frequently Asked Questions

Who can exploit this issue?

Any local user able to send a request to the gssproxy Unix socket can trigger the crash. The malformed GSSX_INIT_SEC_CONTEXT request does not require authentication.

What is the operational impact of a successful exploit?

The gssproxy daemon crashes and does not restart automatically, creating a persistent denial of service. Services that depend on it, including Kerberized NFS and IdM, may also be affected.

How can administrators determine whether they are affected?

Systems using the openeuler/gssproxy package are in scope. A crash triggered by a GSSX_INIT_SEC_CONTEXT request with an absent target_name field indicates exposure to this vulnerability.

OESA-2026-4826: gssproxy security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact of a successful exploit?

How can administrators determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact of a successful exploit?

How can administrators determine whether they are affected?