Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Hardened Images 1 hummingbird:1 | krb5 | 0:1.22.3-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | krb5-devel | 0:1.22.3-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | krb5-libs | 0:1.22.3-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | krb5-pkinit | 0:1.22.3-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | krb5-server | 0:1.22.3-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | krb5-server-ldap | 0:1.22.3-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | krb5-tests | 0:1.22.3-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | krb5-workstation | 0:1.22.3-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | krb5-xrealmauthz | 0:1.22.3-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | libkadm5 | 0:1.22.3-0.1.hum1 |
Vulnerabilities 13
-
High 7.5
Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries
clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatche…
-
High 7.5
Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote atta…
-
High 7.5
Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT re…
-
High 7.5
Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by acc…
-
High 7.5
Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request all…
-
High 7.5
Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthe…
-
Medium 6.5
MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more ti…
-
Medium 6.5
Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failure
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a …
-
Medium 6.5
Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointe…
-
Medium 6.5
Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that tri…
-
Medium 5.3
Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failure
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSE…
-
Medium 5.3
Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via…
-
Medium 4.9
MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-107364
-
report
https://access.redhat.com/security/cve/CVE-2026-107708
-
report
https://access.redhat.com/security/cve/CVE-2026-107778
-
report
https://access.redhat.com/security/cve/CVE-2026-107884
-
report
https://access.redhat.com/security/cve/CVE-2026-111423
-
report
https://access.redhat.com/security/cve/CVE-2026-112314
-
report
https://access.redhat.com/security/cve/CVE-2026-112315
-
report
https://access.redhat.com/security/cve/CVE-2026-112316
-
report
https://access.redhat.com/security/cve/CVE-2026-112317
-
report
https://access.redhat.com/security/cve/CVE-2026-112318
-
report
https://access.redhat.com/security/cve/CVE-2026-112319
-
report
https://access.redhat.com/security/cve/CVE-2026-112320
-
report
https://access.redhat.com/security/cve/CVE-2026-112321
-
report
https://access.redhat.com/security/cve/CVE-2026-112322
-
report
https://access.redhat.com/security/cve/CVE-2026-112323
-
report
https://access.redhat.com/security/cve/CVE-2026-118380
-
report
https://access.redhat.com/security/cve/CVE-2026-119079
-
report
https://access.redhat.com/security/cve/CVE-2026-71199
-
report
https://access.redhat.com/security/cve/CVE-2026-71200
-
article
https://access.redhat.com/security/updates/classification/
-
article
https://images.redhat.com/
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_97811.json
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2563453
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-71199
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-71199
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478447
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-71200
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-71200
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2569161
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-107364
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-107364
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548262
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-107708
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-107708
-
article
https://github.com/krb5/krb5
-
article
https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676
-
article
https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d
-
article
https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7
-
article
https://github.com/krb5/krb5/pull/1510