In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-xrealmauthzUpgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-serverUpgrade krb5-develUpgrade libkadm5Upgrade krb5-pkinitUpgrade krb5-workstation | May 13, 2026 | May 13, 2026 |
| Amazon_linux_2023 | — | Upgrade krb5-develUpgrade krb5-libsUpgrade krb5-pkinitUpgrade libkadm5-debuginfoUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-server-debuginfoUpgrade krb5-workstationUpgrade krb5-libs-debuginfoUpgrade krb5-debuginfoUpgrade krb5-server-ldapUpgrade krb5-pkinit-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-debugsourceUpgrade krb5-server-ldap-debuginfo | May 19, 2026 | Apr 28, 2026 |
| Debian | — | Upgrade krb5 | May 24, 2026 | May 24, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jul 2, 2026 | Jun 30, 2026 |
| Oracle_linux | — | Upgrade krb5-workstationUpgrade krb5-develUpgrade krb5-pkinitUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-server-ldapUpgrade krb5-libs | May 21, 2026 | Apr 28, 2026 |
| Redhat_linux | — | Upgrade krb5-debugsourceUpgrade krb5-develUpgrade krb5-workstation-debuginfoUpgrade krb5-workstationUpgrade krb5-serverUpgrade libkadm5-debuginfoUpgrade krb5-server-ldapUpgrade krb5-pkinitUpgrade libkadm5Upgrade krb5-xrealmauthzUpgrade krb5-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-server-ldap-debuginfoNo solution existsUpgrade krb5-pkinit-debuginfoUpgrade krb5-libsUpgrade krb5-devel-debuginfoUpgrade krb5-xrealmauthz-debuginfo | May 13, 2026 | Apr 28, 2026 |
| Rocky_linux | — | Upgrade krb5-libsUpgrade krb5-serverUpgrade krb5-pkinitUpgrade libkadm5-debuginfoUpgrade krb5-develUpgrade krb5-server-debuginfoUpgrade krb5-workstationUpgrade krb5-libs-debuginfoUpgrade libkadm5Upgrade krb5-xrealmauthzUpgrade krb5-pkinit-debuginfoUpgrade krb5-debuginfoUpgrade krb5-debugsourceUpgrade krb5-devel-debuginfoUpgrade krb5-server-ldapUpgrade krb5-xrealmauthz-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-workstation-debuginfo | May 18, 2026 | May 14, 2026 |
| Ubuntu | — | Upgrade krb5-admin-serverUpgrade libkrb5-3Upgrade krb5-kdc | Jul 22, 2026 | Apr 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub