High ELSA-2026-19357 2 CVEs

Important: krb5 security update (Oracle Linux 9)

Published Jun 23, 2026 · Updated Jun 23, 2026

Ecosystem: Oracle Linux

Summary

[1.21.1-10.0.1]
- Fixed race condition in krb5_set_password() [Orabug: 33609767]

[1.21.1-10]
- Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
Resolves: RHEL-171590 RHEL-171596

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 9	krb5-devel	0:1.21.1-10.0.1.el9_8
Oracle Linux · 9	krb5-libs	0:1.21.1-10.0.1.el9_8
Oracle Linux · 9	krb5-pkinit	0:1.21.1-10.0.1.el9_8
Oracle Linux · 9	krb5-server	0:1.21.1-10.0.1.el9_8
Oracle Linux · 9	krb5-server-ldap	0:1.21.1-10.0.1.el9_8
Oracle Linux · 9	krb5-workstation	0:1.21.1-10.0.1.el9_8
Oracle Linux · 9	krb5-xrealmauthz	0:1.21.1-10.0.1.el9_8
Oracle Linux · 9	libkadm5	0:1.21.1-10.0.1.el9_8

Vulnerabilities 2

Medium 5.9

CVE-2026-40355

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_…

MIT Kerberos 5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Apr 28, 2026
Medium 5.9

CVE-2026-40356

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an applic…

MIT Kerberos 5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Apr 28, 2026