In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-workstationUpgrade krb5-develUpgrade krb5-pkinitUpgrade krb5-serverUpgrade krb5-xrealmauthzUpgrade krb5-libsUpgrade libkadm5Upgrade krb5-server-ldap | May 13, 2026 | May 13, 2026 |
| Amazon_linux_2023 | — | Upgrade krb5-server-debuginfoUpgrade krb5-serverUpgrade krb5-server-ldap-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-debuginfoUpgrade krb5-pkinitUpgrade krb5-workstation-debuginfoUpgrade krb5-develUpgrade libkadm5Upgrade krb5-server-ldapUpgrade libkadm5-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-libsUpgrade krb5-debugsourceUpgrade krb5-workstation | May 19, 2026 | Apr 28, 2026 |
| Debian | — | Upgrade krb5 | May 26, 2026 | May 26, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jul 2, 2026 | Jun 30, 2026 |
| Oracle_linux | — | Upgrade krb5-develUpgrade krb5-workstationUpgrade krb5-pkinitUpgrade libkadm5Upgrade krb5-serverUpgrade krb5-libsUpgrade krb5-server-ldap | May 21, 2026 | Apr 28, 2026 |
| Redhat_linux | — | Upgrade krb5-xrealmauthz-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-develUpgrade krb5-devel-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-serverUpgrade krb5-xrealmauthzUpgrade krb5-debugsourceUpgrade krb5-workstationUpgrade krb5-libsUpgrade libkadm5-debuginfoUpgrade libkadm5Upgrade krb5-server-ldapUpgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-pkinitNo solution exists | May 13, 2026 | Apr 28, 2026 |
| Rocky_linux | — | Upgrade krb5-server-ldap-debuginfoUpgrade krb5-xrealmauthz-debuginfoUpgrade krb5-server-ldapUpgrade krb5-pkinitUpgrade krb5-workstation-debuginfoUpgrade krb5-xrealmauthzUpgrade krb5-debuginfoUpgrade krb5-debugsourceUpgrade krb5-server-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-workstationUpgrade krb5-develUpgrade krb5-devel-debuginfoUpgrade krb5-serverUpgrade krb5-libsUpgrade libkadm5-debuginfoUpgrade libkadm5Upgrade krb5-pkinit-debuginfo | May 18, 2026 | May 14, 2026 |
| Ubuntu | — | Upgrade krb5-kdcUpgrade krb5-admin-serverUpgrade libkrb5-3 | Jul 22, 2026 | Apr 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub