In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-serverUpgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-xrealmauthzUpgrade libkadm5Upgrade krb5-pkinitUpgrade krb5-workstationUpgrade krb5-devel | May 13, 2026 | May 13, 2026 |
| Amazon_linux_2023 | — | Upgrade krb5-workstation-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-debuginfoUpgrade krb5-pkinitUpgrade krb5-serverUpgrade krb5-libs-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-develUpgrade krb5-debugsourceUpgrade libkadm5Upgrade krb5-workstationUpgrade krb5-server-ldapUpgrade krb5-libsUpgrade libkadm5-debuginfoUpgrade krb5-pkinit-debuginfo | May 19, 2026 | Apr 28, 2026 |
| Debian | — | Upgrade krb5 | May 26, 2026 | May 26, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jul 2, 2026 | Jun 30, 2026 |
| Oracle_linux | — | Upgrade krb5-server-ldapUpgrade krb5-serverUpgrade krb5-workstationUpgrade libkadm5Upgrade krb5-develUpgrade krb5-pkinitUpgrade krb5-xrealmauthzUpgrade krb5-libs | May 21, 2026 | Apr 28, 2026 |
| Redhat_linux | — | No solution existsUpgrade krb5-pkinitUpgrade krb5-pkinit-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-develUpgrade krb5-devel-debuginfoUpgrade krb5-debuginfoUpgrade krb5-xrealmauthz-debuginfoUpgrade krb5-debugsourceUpgrade libkadm5Upgrade krb5-server-ldapUpgrade krb5-xrealmauthzUpgrade krb5-server-debuginfoUpgrade krb5-serverUpgrade libkadm5-debuginfoUpgrade krb5-libsUpgrade krb5-libs-debuginfoUpgrade krb5-workstation | May 13, 2026 | Apr 28, 2026 |
| Rocky_linux | — | Upgrade krb5-libsUpgrade krb5-serverUpgrade krb5-devel-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade libkadm5-debuginfoUpgrade libkadm5Upgrade krb5-develUpgrade krb5-debugsourceUpgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-xrealmauthzUpgrade krb5-pkinitUpgrade krb5-xrealmauthz-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-server-ldapUpgrade krb5-workstation-debuginfoUpgrade krb5-debuginfoUpgrade krb5-workstation | May 18, 2026 | May 14, 2026 |
| Ubuntu | — | Upgrade libkrb5-3Upgrade krb5-admin-serverUpgrade krb5-kdc | Jul 22, 2026 | Apr 28, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 2, 2026 | Apr 28, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub