UBUNTU-CVE-2026-119079: High severity ubuntu/krb5 vulnerability

Published Nov 10, 2026

Updated

decodesequenceof() in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

Affected Software

8 affected components

ubuntu/krb5*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this denial-of-service issue?

Kerberos KDCs using affected MIT Kerberos 5 versions are exposed when they accept AS-REQ or TGS-REQ requests over TCP. Systems that do not operate a KDC are not identified as affected by the available information.

Does an attacker need credentials or user interaction to exploit this?

No. An attacker can send an unauthenticated AS-REQ or TGS-REQ containing a large number of elements in a SEQUENCE OF field, and no user interaction is required.

What is the operational impact of exploitation?

Exploitation consumes CPU resources in the KDC, potentially causing a denial of service. The available information identifies no confidentiality or integrity impact.

What can be done if patching cannot happen immediately?

The provided information only identifies requests delivered over TCP as the attack path. No specific workaround or configuration mitigation is provided.

UBUNTU-CVE-2026-119079: High severity ubuntu/krb5 vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this denial-of-service issue?

Does an attacker need credentials or user interaction to exploit this?

What is the operational impact of exploitation?

What can be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this denial-of-service issue?

Does an attacker need credentials or user interaction to exploit this?

What is the operational impact of exploitation?

What can be done if patching cannot happen immediately?