High ELSA-2026-19145 2 CVEs

Important: krb5 security update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[1.21.3-10.0.1]
- Fixed race condition in krb5_set_password() [Orabug: 33609767]

[1.21.3-10]
- Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
Resolves: RHEL-171588 RHEL-171597

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 10	krb5-devel	0:1.21.3-10.0.1.el10_2
Oracle Linux · 10	krb5-libs	0:1.21.3-10.0.1.el10_2
Oracle Linux · 10	krb5-pkinit	0:1.21.3-10.0.1.el10_2
Oracle Linux · 10	krb5-server	0:1.21.3-10.0.1.el10_2
Oracle Linux · 10	krb5-server-ldap	0:1.21.3-10.0.1.el10_2
Oracle Linux · 10	krb5-workstation	0:1.21.3-10.0.1.el10_2
Oracle Linux · 10	krb5-xrealmauthz	0:1.21.3-10.0.1.el10_2
Oracle Linux · 10	libkadm5	0:1.21.3-10.0.1.el10_2

Vulnerabilities 2

Medium 5.9

CVE-2026-40355

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_…

MIT Kerberos 5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Apr 28, 2026
Medium 5.9

CVE-2026-40356

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an applic…

MIT Kerberos 5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Apr 28, 2026