https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 19:27:03 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-11850 <p><strong>Affected:</strong> Alpaquita:23: krb5, Alpaquita:25: krb5, Alpaquita:stream: krb5</p> <p><strong>Affected:</strong> Alpaquita:23: krb5, Alpaquita:25: krb5, Alpaquita:stream: krb5</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-11850 https://cve.radiocsirt.org/vuln/euvd-2026-361980 EUVD-2026-361980 https://cve.radiocsirt.org/vuln/euvd-2026-361980 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11850 <p>An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len &lt; 2, triggering the underflow when the KDC or kadmind reads principal data.</p> <p>An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len &lt; 2, triggering the underflow when the KDC or kadmind reads principal data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11850 https://cve.radiocsirt.org/vuln/ghsa-85rq-mqr4-hjw7 <p>An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len &lt; 2, triggering the underflow when the KDC or kadmind reads principal data.</p> <p>An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len &lt; 2, triggering the underflow when the KDC or kadmind reads principal data.</p> https://cve.radiocsirt.org/vuln/ghsa-85rq-mqr4-hjw7 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11177-1 <p>krb5-1.22.2-4.1 on GA media</p> <p>krb5-1.22.2-4.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11177-1 https://cve.radiocsirt.org/vuln/rhsa-2026:25520 <p>krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read</p> <p>krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read</p> https://cve.radiocsirt.org/vuln/rhsa-2026:25520 https://cve.radiocsirt.org/vuln/suse-su-2026:22450-1 <p>Security update for krb5</p> <p>Security update for krb5</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22450-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-11850 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: krb5, Ubuntu:Pro:16.04:LTS: krb5, Ubuntu:Pro:18.04:LTS: krb5, Ubuntu:20.04:LTS: krb5, Ubuntu:22.04:LTS: krb5, Ubuntu:24.04:LTS: krb5, Ubuntu:25.10: krb5, Ubuntu:26.04:LTS: krb5</p> <p>An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len &lt; 2, triggering the underflow when the KDC or kadmind reads principal data.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: krb5, Ubuntu:Pro:16.04:LTS: krb5, Ubuntu:Pro:18.04:LTS: krb5, Ubuntu:20.04:LTS: krb5, Ubuntu:22.04:LTS: krb5, Ubuntu:24.04:LTS: krb5, Ubuntu:25.10: krb5, Ubuntu:26.04:LTS: krb5</p> <p>An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len &lt; 2, triggering the underflow when the KDC or kadmind reads principal data.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-11850 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1900 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MIT Kerberos ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MIT Kerberos ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1900