In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gssacceptseccontext() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parsemessage.
In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdblog.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.
An integer underflow vulnerability was found in MIT krb5 in the berval2tldata() function in plugins/kdb/ldap/libkdbldap/ldapprincipal2.c. The function performs an unsigned subtraction (bvlen - 2) without a prior bounds check. When bvlen is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.
The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bvlen < 2, triggering the underflow when the KDC or kadmind reads principal data.
Upstream fix: https://github.com/krb5/krb5/commit/2a5fd83 MIT ticket: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9206
An integer underflow vulnerability was found in MIT krb5 in the berval2tldata() function in plugins/kdb/ldap/libkdbldap/ldapprincipal2.c. The function performs an unsigned subtraction (bvlen - 2) without a prior bounds check. When bvlen is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.
The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bvlen < 2, triggering the underflow when the KDC or kadmind reads principal data.
Upstream fix: https://github.com/krb5/krb5/commit/2a5fd83 MIT ticket: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9206
A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.
Reference: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869
Upstream patch: https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1
A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can cause a null dereference in kadmind, or circumvent a DN container check, by supplying tagged data intended to be internal to the database module.
Reference: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869
Upstream patch: https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1
Hi,
just a quick note that MIT krb5 has fixed two unauthenticated network NegoEx parsing vulnerabilities.
Affected versions:
MIT krb5 1.18 and later, when an application calls gssacceptseccontext() on a system with a NegoEx mechanism registered in /etc/gss/mech
Description:
CVE-2026-40355 is a null pointer dereference in parsenegomessage(). The result of the second vectorbase() call was not checked before being dereferenced. An unauthenticated remote attacker can trigger this issue and crash the process.
CVE-2026-40356 is a read overrun of up to 52 bytes in parsemessage(). A short headerlen could cause an integer underflow while calculating the remaining message length. An unauthenticated remote attacker can trigger this issue and possibly crash the proces. Exfiltration of the bytes read appears unlikely.
MIT krb5 security confirmed the following CVSS v3.1 vectors:
CVE-2026-40355: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Base score: 7.5
CVE-2026-40356: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Base score: 5.9
Users are recommended to apply the upstream patch or update to a version containing the fix.
Credit: Cem Onat Karagun
References: https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html https://www.youtube.com/watch?v=zpBrriAJxCQ