MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in makecredlist() in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through gssacceptseccontext() to crash GSS-API acceptor services, causing denial of service.

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parsenegomessage.

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: Pre-auth Memory Leak in RPCSECGSS Credential Decode Failure Path (gssrpcsvcauthgss): malformed unauthenticated RPCSECGSS credentials can leak gcctx allocations on decode failure, allowing gradual memory-exhaustion denial of service. Requirements to exploit: Network reachability to a service from krb5-1.21.3-8.el100 that parses RPCSECGSS credentials before authentication, plus the ability to send repeated malformed RPC requests with a truncated embedded gcctx buffer. No prior authentication or user interaction is required. Component affected: krb5-1.21.3-8.el100, src/lib/rpc/svcauthgss.c, gssrpcsvcauthgss (with the leaking allocation originating from xdrrpcgsscred() via xdrrpcgssbuf() / xdrbytes()) Version affected: krb5-1.21.3-8.el100 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - 5.3 (MEDIUM) AV:N - The affected code parses attacker-controlled RPC credential data over the network. AC:L - The failure condition is induced with a malformed but simple truncated credential blob. PR:N - The leak occurs in the pre-authentication credential decode path. UI:N - No user interaction is required. S:U - The impact is limited to the targeted service process. C:N - The available evidence does not show unauthorized data disclosure. I:N - The available evidence does not show data modification or code execution. A:L - Each request leaks only a bounded amount of memory (MAXAUTHBYTES), but repeated requests can accumulate enough loss to degrade or eventually exhaust the service. Impact: Important. Red Hat classifies flaws that allow remote users to cause denial of service as Important, and this issue is reachable before authentication where an exposed RPCSECGSS service path exists. The practical effect established here is gradual availability loss rather than immediate crash or system compromise, because the leak is bounded per request and requires repetition. Embargo: no Reason: The demonstrated impact is availability-only, the leak is gradual, and straightforward mitigations exist by restricting network access to affected RPCSECGSS-enabled administrative services while a fix is prepared. Acknowledgement: Aisle Research Vulnerability Details: In gssrpcsvcauthgss(), a decode failure returns immediately instead of using the existing freegc: cleanup path: c if (!xdrrpcgsscred(&xdrs, gc)) { logdebug("xdrrpcgsscred() failed"); XDRDESTROY(&xdrs); return (AUTHBADCRED); } ... freegc: xdrfree((xdrproct)xdrrpcgsscred, gc); logdebug("returning %d from svcauthgss()", retstat); return (retstat); The decoded gcctx field is populated through xdrrpcgssbuf() and xdrbytes(). On XDRDECODE, xdrbytes() allocates the buffer before it attempts to read the declared opaque bytes. If the embedded RPCSECGSS credential advertises a non-zero gcctx length but truncates the remaining credential bytes, the opaque read can fail after allocation. Because the function returns before xdrfree((xdrproct)xdrrpcgsscred, gc) is reached, that nested allocation is not released on the failing request. The available material further supports that this parser is selected from the server authentication dispatch when cbcred.oaflavor is RPCSECGSS. The resulting leak is bounded per request by the credential-size checks, but repeated malformed unauthenticated requests can cause monotonic memory growth over time. The evidence supports this for deployments that expose an RPCSECGSS-enabled service path, including in-tree administrative paths such as kadmind or iprop; it does not establish that every deployment of the SRPM exposes those paths. Steps to reproduce: 1. Reach a server path built from krb5-1.21.3-8.el100 that accepts RPCSECGSS credentials before authentication. 2. Send an RPC call with cbcred.oaflavor = RPCSECGSS. 3. Keep the outer credential blob within the accepted MAXAUTHBYTES limit so decoding proceeds into the embedded RPCSECGSS credential. 4. Inside the embedded credential, set gcctx to a non-zero declared length but truncate the remaining bytes so allocation occurs and the subsequent opaque-byte read fails. 5. Observe an authentication failure associated with AUTHBADCRED while the service retains the allocation from the failed decode path. 6. Repeat the malformed request and monitor service memory growth over time. Mitigation: Restrict network access to RPCSECGSS-enabled administrative services to trusted clients until a fix is available. Where feasible, do not expose kadmind/iprop-related RPC endpoints to untrusted networks, and apply rate limiting or connection controls to reduce the effect of repeated malformed requests. Proposed Fix: Route the decode-failure path through the existing freegc: cleanup so partially decoded RPCSECGSS credentials are always released. diff diff --git a/krb5-1.21.3/src/lib/rpc/svcauthgss.c b/krb5-1.21.3/src/lib/rpc/svcauthgss.c index <old>..<new> 100644 — a/krb5-1.21.3/src/lib/rpc/svcauthgss.c +++ b/krb5-1.21.3/src/lib/rpc/svcauthgss.c @@ -434,10 +434,12 @@ gssrpcsvcauthgss(struct svcreq rqst, struct rpcmsg msg, rqst->rqcred.oalength, XDRDECODE); logdebug("xdrmemcreate() returned"); if (!xdrrpcgsscred(&xdrs, gc)) { logdebug("xdrrpcgsscred() failed"); XDRDESTROY(&xdrs); return (AUTHBADCRED); + retstat = AUTHBADCRED; + goto freegc; } XDRDESTROY(&xdrs);

An equivalent fix is to call xdrfree((xdrproct)xdrrpcgsscred, gc) immediately before returning AUTHBADCRED. ------ This report was generated using AI technology. Always review AI-generated content prior to use

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: RPCSECGSS Auth-Flavor Switching Causes Unbounded Per-Connection Memory Leak (Unauthenticated DoS): switching a persistent TCP connection from RPCSECGSS to AUTHNONE, AUTHUNIX, or AUTHSHORT can orphan heap-backed auth state and let an unauthenticated remote client exhaust server memory. Requirements to exploit: The attacker must be able to reach a service built from krb5-1.21.3-8.el100 that uses the src/lib/rpc GSS-RPC server path over a long-lived TCP connection with RPCSECGSS enabled. No prior authentication or user interaction is required. Component affected: krb5-1.21.3-8.el100 GSS-RPC server authentication lifecycle in src/lib/rpc, notably svcdoxprt() in svc.c, gssrpcauthenticate() in svcauth.c, gssrpcsvcauthgss() in svcauthgss.c, and the non-GSS handlers in svcauthnone.c and svcauthunix.c. Version affected: krb5-1.21.3-8.el100 (reachable when a service from this SRPM exposes the GSS-RPC server path over persistent TCP with RPCSECGSS enabled) Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 7.5 (HIGH) AV:N - The attack is performed by sending RPC traffic over the network to an exposed service. AC:L - Once the affected TCP GSS-RPC path is reachable, alternating auth flavors on one connection is straightforward and repeatable. PR:N - The leak can be triggered before successful authentication is established. UI:N - No user interaction is required. S:U - The impact is limited to the vulnerable service's own security scope. C:N - No confidentiality impact is demonstrated. I:N - No integrity impact is demonstrated. A:H - Repetition can drive unbounded memory growth until the service becomes unavailable or is terminated. Impact: Important. The demonstrated effect is an unauthenticated remote denial of service through memory exhaustion on a network-reachable service, which aligns with Red Hat's Important rating for remote DoS. It is not Critical because no system compromise or confidentiality/integrity impact is shown, and reachability depends on a deployment exposing the affected RPCSECGSS TCP path. Embargo: no Reason: This is an availability-only issue with configuration-dependent reachability, and administrators can reduce exposure by restricting access to the affected service. The available evidence does not show code execution or silent data compromise that would strongly justify delayed public disclosure. Acknowledgement: Aisle Research Vulnerability Details: The issue is a lifecycle mismatch for xprt->xpauth. gssrpcsvcauthgss() allocates heap-backed SVCAUTH/GSS private state and stores it on the transport. svcdoxprt() intentionally preserves RPCSECGSS auth handles across requests, but later non-GSS authenticators overwrite the same pointer with the static &svcauthnone handle without first calling SVCAUTHDESTROY(). After the overwrite, the original heap object is no longer reachable and leaks until process exit. In src/lib/rpc/svcauthgss.c, RPCSECGSS authentication attaches per-connection auth state to the transport: c if (rqst->rqxprt->xpauth == NULL || rqst->rqxprt->xpauth == &svcauthnone) { ... auth->svcahops = &svcauthgssops; SVCAUTHPRIVATE(auth) = gd; rqst->rqxprt->xpauth = auth; } In src/lib/rpc/svc.c, non-GSS auth handles are nulled at request teardown, while GSS handles are intentionally retained: c } else if ((xprt->xpauth != NULL) && (xprt->xpauth->svcahops != &svcauthgssops)) { xprt->xpauth = NULL; } In src/lib/rpc/svcauthnone.c, and likewise in gssrpcsvcauthunix() and gssrpcsvcauthshort(), a later non-GSS request overwrites the transport pointer: c rqst->rqxprt->xpauth = &svcauthnone; An unauthenticated client can therefore keep one TCP connection open, send an RPCSECGSS INIT or CONTINUEINIT request to allocate xpauth, then switch to AUTHNONE, AUTHUNIX, or AUTHSHORT on the same connection to orphan that state. Repeating the sequence causes monotonic heap/RSS growth bounded only by available memory. The available evidence supports availability impact only. Steps to reproduce: 1. Run a service built from krb5-1.21.3-8.el100 that uses the src/lib/rpc server stack over TCP with RPCSECGSS enabled. 2. Keep a single TCP connection open to the service. 3. Send one RPCSECGSS request on that connection, such as INIT or CONTINUEINIT, so gssrpcsvcauthgss() allocates xpauth. 4. On the same connection, send a request using AUTHNONE, AUTHUNIX, or AUTHSHORT so xpauth is overwritten. 5. Repeat steps 3 and 4 in a loop. 6. Observe monotonic memory growth in the server process; repeated switching can eventually exhaust memory and make the service unavailable. Mitigation: Restrict network access to affected GSS-RPC services to trusted clients until a fix is available. Deployments that do not expose the vulnerable TCP GSS-RPC path or do not enable RPCSECGSS are not reachable through this issue. If memory growth is observed, restart the affected service to reclaim leaked memory. Proposed Fix: Centralize cleanup in gssrpcauthenticate() before dispatching to non-RPCSECGSS authenticators so auth-flavor switching cannot orphan the previous heap allocation. diff diff --git a/src/lib/rpc/svcauth.c b/src/lib/rpc/svcauth.c — a/src/lib/rpc/svcauth.c +++ b/src/lib/rpc/svcauth.c @@ -38,6 +38,7 @@ / #include <gssrpc/rpc.h> +extern struct svcauthops svcauthgssops; / Server side authenticators are called from authenticate by @@ -92,6 +93,14 @@ gssrpcauthenticate( rqst->rqxprt->xpverf.oalength = 0; credflavor = rqst->rqcred.oaflavor; nodispatch = FALSE; + + / Drop stale RPCSECGSS auth state if client switches flavor. / + if (rqst->rqxprt->xpauth != NULL && + rqst->rqxprt->xpauth->svcahops == &svcauthgssops && + credflavor != RPCSECGSS) { + SVCAUTHDESTROY(rqst->rqxprt->xpauth); + rqst->rqxprt->xpauth = NULL; + } + for (i = 0; i < svcauthnum; i++) { if (credflavor == svcauthsw[i].flavor && svcauthsw[i].authenticator != NULL) {

------ This report was generated using AI technology. Always review AI-generated content prior to use

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: DoS in kadmind via NULL dereference in unauthorized policy logging (logunauth): an authenticated but unauthorized client can send a crafted policy RPC request with a NULL policy name and crash kadmind through strlen(NULL) in the unauthorized logging path. Requirements to exploit: A running and reachable kadmind instance, a valid principal that can issue admin RPC requests but lacks policy-administration rights, and the ability to send a crafted RPC request that encodes the policy name as an XDR nullstring (size=0) instead of relying on normal kadmin CLI validation. Component affected: krb5 kadmind policy RPC handling in src/kadmin/server/serverstubs.c (logunauth(), createpolicy2svc(), deletepolicy2svc(), modifypolicy2svc(), getpolicy2svc()), with NULL policy-name inputs admitted by src/lib/kadm5/kadmrpcxdr.c Version affected: krb5-1.21.3-8.el100 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 6.5 (MEDIUM) AV:N - The vulnerable path is reachable over the network through kadmind RPC requests. AC:L - Exploitation requires only a crafted policy RPC request with a NULL XDR string; no race or unusual environmental condition was established. PR:L - The attacker must authenticate, but does not need policy-administration privileges. UI:N - No user interaction is required. S:U - The crash affects the same kadmind security scope. C:N - No confidentiality impact was established. I:N - No integrity impact was established. A:H - The NULL dereference can terminate kadmind, denying administrative service until it is restarted. Impact: Important. This issue allows a remote authenticated attacker to cause a denial of service in kadmind, which aligns with Red Hat's Important category for flaws that allow remote users to impact availability. It is not Critical because authentication is required and no confidentiality, integrity, or code-execution impact was established. Embargo: no Reason: The available evidence supports an authenticated denial of service in an administrative daemon, with no demonstrated confidentiality or integrity impact and straightforward operational mitigations while a fix is prepared. Acknowledgement: Aisle Research Vulnerability Details: In src/kadmin/server/serverstubs.c, logunauth() calls strlen(target) without first checking whether target is NULL: c static int logunauth( char op, char target, gssbuffert client, gssbuffert server, struct svcreq rqstp) { sizet tlen, clen, slen; char tdots, cdots, sdots; tlen = strlen(target); truncname(&tlen, &tdots); clen = client->length; truncname(&clen, &cdots); slen = server->length; truncname(&slen, &sdots); / okay to cast lengths to int because truncname limits max value / return krb5klogsyslog(LOGNOTICE, ("Unauthorized request: %s, %.s%s, " "client=%.s%s, service=%.s%s, addr=%s"), op, (int)tlen, target, tdots, (int)clen, (char )client->value, cdots, (int)slen, (char )server->value, sdots, clientaddr(rqstp->rqxprt)); } The policy RPC handlers createpolicy2svc(), deletepolicy2svc(), modifypolicy2svc(), and getpolicy2svc() pass request-derived arg->rec.policy or arg->name directly into logunauth() when authorization fails. Those policy-name fields are decoded with xdrnullstring(), and a zero-length XDR string is accepted and decoded to NULL. As a result, an authenticated caller can send a crafted policy request with a NULL policy name, force the unauthorized branch, and reach strlen(NULL) in the logging path. The success-path logging already substitutes "(null)" for NULL names, so the crash is specific to unauthorized-request logging. Steps to reproduce: 1. Run kadmind. 2. Authenticate as a valid principal that can issue admin RPC requests but lacks policy-administration rights. 3. Send one of CREATEPOLICY, DELETEPOLICY, MODIFYPOLICY, or GETPOLICY with the policy name encoded as an XDR nullstring (size=0), so the server decodes the field to NULL. 4. Ensure the request follows the unauthorized branch. 5. logunauth(..., target=NULL, ...) executes strlen(NULL), causing a SIGSEGV and denial of kadmind service. Normal kadmin client-side checks may reject NULL names, so reproduction appears to require a crafted RPC request rather than the stock CLI. Mitigation: Restrict network access to kadmind to trusted administrative hosts and limit which principals can authenticate to the admin RPC service. Where the service is not required, disabling kadmind removes reachability. These measures reduce exposure but do not remove the vulnerable code path from a reachable instance. Proposed Fix: A minimal fix is to make logunauth() handle a NULL target the same way logdone() already does. diff diff --git a/src/kadmin/server/serverstubs.c b/src/kadmin/server/serverstubs.c — a/src/kadmin/server/serverstubs.c +++ b/src/kadmin/server/serverstubs.c @@ -384,6 +384,9 @@ logunauth( sizet tlen, clen, slen; char tdots, cdots, sdots; + if (target == NULL) + target = "(null)"; + tlen = strlen(target); truncname(&tlen, &tdots); ------ This report was generated using AI technology. Always review AI-generated content prior to use

AIONLYREPORT package: krb5-1.21.3-8.el100 ------ Summary: Unauthenticated Memory-Exhaustion DoS in kadmind legacy AUTHGSSAPI handshake (svcauthgssapi.c): repeated unauthenticated AUTHGSSAPIINIT failures can allocate per-client state that is retained until timeout-based cleanup, allowing remote memory-pressure denial of service. Requirements to exploit: Network reachability to a kadmind admin RPC endpoint and the ability to send crafted unauthenticated AUTHGSSAPIINIT requests that reach the legacy server-side AUTHGSSAPI handler; no valid Kerberos credentials or user interaction are required. Component affected: krb5-1.21.3-8.el100, src/lib/rpc/svcauthgssapi.c, gssrpcsvcauthgssapi() legacy AUTHGSSAPI handshake path reachable via kadmind Version affected: krb5-1.21.3-8.el100 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 7.5 (HIGH) AV:N - The attack is delivered over the network to a reachable kadmind RPC service. AC:L - Repeated malformed AUTHGSSAPIINIT traffic is sufficient; no race or unusual precondition is established. PR:N - No Kerberos credentials or other prior authentication are required. UI:N - No user interaction is needed. S:U - The impact stays within the authority of the vulnerable service. C:N - No confidentiality impact is established from the available evidence. I:N - No integrity impact is established from the available evidence. A:H - Repeated retained allocations can drive sustained memory growth and deny service. Impact: Important. Red Hat classifies flaws that allow remote users to cause a denial of service as Important when they can compromise availability of resources. Here, the established effect is unauthenticated remote memory exhaustion against a reachable kadmind service. Critical is not supported because the evidence does not show arbitrary code execution or broader system compromise, and the demonstrated impact is availability-only. Embargo: no Reason: The established impact is denial of service on an administrative service, and exposure can be materially reduced by restricting network access to kadmind while a fix is prepared. Private coordination is still useful, but the currently established impact does not strongly support an extended embargo. Acknowledgement: Aisle Research Vulnerability Details: In gssrpcsvcauthgssapi(), an AUTHGSSAPIINIT request with an empty client handle creates new per-client state before context establishment. That state is inserted into the global clients list and given a 15-minute initiation timeout. When context establishment fails, the function sends an error response and returns through error: without destroying the just-created entry. c if (creds.authmsg && rqst->rqproc == AUTHGSSAPIINIT) { ... clientdata = createclient(); ... } c clientdata->expiration = time(0) + INITIATIONTIMEOUT; / 6015 / c if (callres.gssmajor != GSSSCOMPLETE && callres.gssmajor != GSSSCONTINUENEEDED) { ... svcsendreply(...); nodispatch = TRUE; ret = AUTHOK; goto error; / no destroyclient(clientdata) / } Repeated unauthenticated failures therefore accumulate retained svcauthgssapidata entries until timeout-based cleanup runs. The same cleanup gap also affects other post-allocation INIT failure paths that return through error: after createclient() has already succeeded, including malformed init arguments or unsupported INIT versions. Based on the available evidence, the established impact is denial of service through attacker-driven memory growth; no confidentiality or integrity impact is established. Steps to reproduce: 1. Run kadmind from this package and ensure the admin RPC service is reachable, typically on 749/tcp. 2. Open one TCP connection to the service. 3. Repeatedly send RPC calls with credential flavor AUTHGSSAPI, procedure AUTHGSSAPIINIT, authmsg = TRUE, an empty clienthandle, and an invalid or malformed init token. Malformed INIT arguments after credential parsing also exercise post-allocation failure handling. 4. Observe that failed INIT requests return an error response while also yielding a fresh clienthandle, indicating that new server-side client state was created. 5. Continue sending failures at a moderate rate and monitor kadmind memory usage. Memory rises and remains elevated until the initiation timeout expires (about 15 minutes), demonstrating unauthenticated memory-pressure denial of service. Mitigation: Restrict network access to the kadmind admin RPC service to trusted management hosts, and apply network filtering or rate limiting for repeated failed AUTHGSSAPIINIT traffic where possible. Until a fix is available, avoid exposing this administrative interface to untrusted networks and monitor kadmind for abnormal memory growth. Proposed Fix: Track whether the current request created a new client entry and destroy that entry on all failure exits so partially initialized state is not left in the global client list. diff — a/src/lib/rpc/svcauthgssapi.c +++ b/src/lib/rpc/svcauthgssapi.c @@ -170,6 +170,7 @@ enum authstat gssrpcsvcauthgssapi( enum authstat ret; OMuint32 retflags; uint32t seqnum; + boolt createdclient = FALSE; @@ -248,6 +249,7 @@ enum authstat gssrpcsvcauthgssapi( if (clientdata == NULL) { ... } + createdclient = TRUE; } else { ... } @@ -461,6 +463,12 @@ enum authstat gssrpcsvcauthgssapi( gssreleasebuffer(&minorstat, &outputtoken); + if (createdclient) { + destroyclient(clientdata); + clientdata = NULL; + rqst->rqxprt->xpauth = &svcauthnone; + createdclient = FALSE; + } svcsendreply(rqst->rqxprt, (xdrproct)xdrauthgssapiinitres, (caddrt) &callres); nodispatch = TRUE; @@ -652,6 +660,12 @@ error: + if (createdclient && clientdata != NULL) { + destroyclient(clientdata); + clientdata = NULL; + rqst->rqxprt->xpauth = &svcauthnone; + createdclient = FALSE; + } if (creds.clienthandle.length != 0) { ... } ------ This report was generated using AI technology. Always review AI-generated content prior to use

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gssacceptseccontext() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parsemessage.

https://mailman.mit.edu/pipermail/kerberos-announce/2026q4/000212.html announces: The MIT Kerberos Team announces the availability of MIT Kerberos 5 Release 1.22.3. Please see below for a list of some major changes included, or consult the README file in the source tree for a more detailed list of significant changes.

RETRIEVING KERBEROS 5 RELEASE 1.22.3 ====================================

You may retrieve the Kerberos 5 Release 1.22.3 source from the following URL:

https://kerberos.org/dist/

The homepage for the krb5-1.22.3 release is:

https://web.mit.edu/kerberos/krb5-1.23/

Further information about Kerberos 5 may be found at the following URL:

https://web.mit.edu/kerberos/

and at the MIT Kerberos Consortium web site:

https://www.kerberos.org/

Major changes in 1.22.3 (2026-11-09) ====================================

This is a bug fix release, with a focus on security issues discovered with the aid of large language models. See https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for information on the risks of continuing to use unpatched releases.

Fix a logic error when checking PAC server checksums [CVE-2026-111423].

Check for unkeyed checksums when validating CAMMAC verifiers [CVE-2026-71199].

Fix a loophole in the KDC's client authdata filtering which could allow clients to include fake PAC and CAMMAC authdata values when requesting service tickets. These fake values would be rejected by application servers, were it not for the two bugs noted above.

Check for the lockdownkeys attribute when processing password change protocol requests in kadmind [CVE-2026-107884].

In libgssrpc, when processing RPC messages using the RPCSECGSS flavor, use the verified service type included in the RPC request to determine how to unwrap arguments and wrap return values, instead of the unverified service type included during authentication [CVE-2026-118380].

In libgssrpc, disable the AUTHGSSAPI server auth flavor unless the "GSSRPCALLOWAUTHGSSAPI" environment variable is set. AUTHGSSAPI is only needed for very old (pre-1.4) clients [CVE-2026-112322] [CVE-2026-112323].

Fix numerous null pointer deferences, read overruns, unbounded memory allocations, and memory leaks that could be used as denial of service attacks against the KDC, kadmind, application servers, or client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200] [CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778] [CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316] [CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319] [CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323] [CVE-2026-119079].

Fix a client crash when a KKDCP proxy daemon closes the TLS session without supplying any response data.

Shut down kpropd gracefully when a termination signal is received, when operating in incremental propagation mode.

Detect when an incremental propagation update is applied to a nonexistent principal; when this happens, force a full resync instead of crashing.

Fix a KDC crash when the LDAP KDB module loses its connection to the LDAP server.

Avoid a crash on macOS when the native API ccache type is used before and after forking a process.

When an application accepts a GSS context without asking for delegated credentials, discard any credentials sent by the initiator without parsing them first.

On Windows, prevent buffer overflows when the KDC sends an unexpectedly long prompt string via OTP preauthentication.

On Windows, move the default per-machine krb5.ini location from C:\ProgramData\MIT\Kerberos to C:\Program Files\MIT\Kerberos5, as the former location could be pre-created by an unutrusted user before KfW installation.

On Windows, add error checking to kfwlogon to ensure that it does not set ACLs on a cache file it did not create.

On Windows, prevent several buffer overflows that could occur if an application passes a large principal name to leashdll APIs.

On Windows, prevent buffer overflows when the LSA cache contains credentials with long principal name components. https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt advises: MITKRB5-SA-2026-001

MIT krb5 Security Advisory 2026-001 Original release: 2026-11-09 Last update: 2026-11-09

Topic: Multiple vulnerabilities fixed in patch 1.22.3

SUMMARY =======

Like many open source projects, MIT krb5 has faced greatly increased scrutiny over the past few months from researchers employing large language models. As a result, release 1.22.3 fixes many more vulnerabilities than a typical MIT krb5 patch release. This advisory discusses the combined impact of those vulnerabilities on unpatched components.

AUTHORIZATION BYPASS ATTACKS ============================

An authenticated attacker can bypass authentication indicator enforcement by requesting a service ticket with fake CAMMAC authorization data. Updating to the 1.22.3 release on the KDC is sufficient to prevent this attack.

An authenticated attacker can bypass an application server's PAC authorization data checks by requesting a service ticket with a fake PAC. Updating to the 1.22.3 release on either the KDC or the affected application server will prevent this attack.

An authenticated attacker with administrative privileges can bypass the lockdownkeys attribute by using the password change protocol instead of the kadmin protocol to modify a principal's keys.

The CVEs in this category include:

CVE-2026-71199 CVE-2026-107884 CVE-2026-111423

DENIAL OF SERVICE ATTACKS =========================

The KDC, kadmind, and GSS-API application servers are all vulnerable to denial of service attacks by unauthenticated attackers. The CVEs in this category include:

CVE-2026-40355 CVE-2026-40356 CVE-2026-71200 CVE-2026-107364 CVE-2026-107708 CVE-2026-107778 CVE-2026-112314 CVE-2026-112315 CVE-2026-112316 CVE-2026-112317 CVE-2026-112318 CVE-2026-112319 CVE-2026-112320 CVE-2026-112321 CVE-2026-112322 CVE-2026-112323 CVE-2026-119079

GSS-RPC USE OF UNVERIFIED SERVICE TYPE ======================================

Application servers using libgssrpc with RPCSECGSS protection may be vulnerable to an active network attack that fools the server into disabling cryptographic protection of RPC arguments and return values. The primary component affected by this vulnerability is kadmind, which serves the kadm5 and iprop RPC protocols.

Using this vulnerability, an active network attacker on the path between a replica KDC and the primary KDC can cause kadmind to reveal the contents of an incremental update reply in plain text. This update may contain sensitive Kerberos database material. Any key information in the incremental update will be encrypted in the master key, but if the master password is not strong, a dictionary attack may reveal the unencrypted key data. Updating to the 1.22.3 release on the primary kadmin server is sufficient to prevent this attack.

We believe that this vulnerability is not exploitable in the kadm5 protocol, because the kadmin client makes an INIT remote procedure call before issuing any substantive RPCs. Because only the server is fooled into disabling encryption, the client will abort the kadmin session when it tries to decode the INIT reply. We also considered scenarios where an attacker replays a modified copy of a recorded kadmin session, but we believe that the replay cache and the use of subkeys prevent this variant of the attack.

The CVE in this category is CVE-2026-118380.

WINDOWS CLIENT VULNERABILITIES ==============================

Applications using leashdll are vulnerable to a buffer overflow (possibly leading to code execution) if the KDC supplies a very long prompt banner. Exploitating this vulnerability may be impossible because only the FAST OTP preauth mechanism permits large prompt banners, and the leashdll APIs do not set a FAST armor cache.

If an application supplies principal names from an untrusted source to leashdll initial ticket functions (such as Leashkinitdlg()), an attacker could cause buffer overflows by supplying long names, possibly leading to code execution.

On a Windows host with untrusted users, an attacker could potentially trick kfwlogon into setting ACL rights on a file of the attacker's choice via a hard link.

On a Windows host with untrusted users, a user could create a krb5.ini file in the default per-machine location prior to Kerberos for Windows installation. This file would then be used by other users, allowing code execution via module loading.

ACKNOWLEDGEMENTS ================

The following individuals and organizations contributed to the discovery of the vulnerabilities fixed in the 1.22.3 release:

Arthur Chan Rahul Hoysala Alexandru-Ionut Jipa Cem Onat Karagun David Korczynski Erin Liman Tristan Madani Alejandro Pacheco Julien Rische Moritz Theile Rickey Visinski

Ada Logics AISLE Anthropic AWS Security Deutsche Bank Red Hat Talence Security

REVISION HISTORY ================

2026-11-09 original release

Copyright (C) 2026 Massachusetts Institute of Technology

DISPUTED The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when authtype has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'authtype' is neither the 'KERBEROSV4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code."

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmaprmt.c.

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5pacparse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/dotgsreq.c via a FAST inner body that lacks a server field.

ecverify in kdc/kdcpreauthec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1encode.c support for BER indefinite lengths lacks a recursion limit.

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

Reference and upstream patch: https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

References:

https://github.com/LuMingYinDetect/krb5defects/blob/main/krb5detect2.md

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmaprmt.c.

References:

https://github.com/LuMingYinDetect/krb5defects/blob/main/krb5detect1.md

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

References:

https://github.com/LuMingYinDetect/krb5defects/blob/main/krb5detect3.md

lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because xdrkadm5principalentrec does not validate the relationship between nkeydata and the keydata array count.

A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.

Reference: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869

Upstream patch: https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1

A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can cause a null dereference in kadmind, or circumvent a DN container check, by supplying tagged data intended to be internal to the database module.

Reference: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869

Upstream patch: https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1

An unspecified third-party database module for the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request, a different vulnerability than CVE-2013-1418.

A null pointer dereference flaw was found in Kerberos's GSS-API spnego security mechanism implemenation. A local user could use this flaw to cause a denial of service (krb5 daemon crash) via invalid ContextFlags for the reqFlags field in the NegTokenInit (RFC 4178).

References: http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=6402

Upstream patch: http://src.mit.edu/fisheye/changelog/krb5/?cs=22099

The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun").

The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (aka "array overrun").