https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:55:25 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:16799 <p><strong>Affected:</strong> AlmaLinux:8: krb5-devel, AlmaLinux:8: krb5-libs, AlmaLinux:8: krb5-pkinit, AlmaLinux:8: krb5-server, AlmaLinux:8: krb5-server-ldap, AlmaLinux:8: krb5-workstation, AlmaLinux:8: libkadm5</p> <p>Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).</p> <p>Security Fix(es):</p> <p>* krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356) * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: krb5-devel, AlmaLinux:8: krb5-libs, AlmaLinux:8: krb5-pkinit, AlmaLinux:8: krb5-server, AlmaLinux:8: krb5-server-ldap, AlmaLinux:8: krb5-workstation, AlmaLinux:8: libkadm5</p> <p>Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).</p> <p>Security Fix(es):</p> <p>* krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356) * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:16799 https://cve.radiocsirt.org/vuln/bdu:2026-12847 bdu:2026-12847 https://cve.radiocsirt.org/vuln/bdu:2026-12847 https://cve.radiocsirt.org/vuln/bell-cve-2026-40355 <p><strong>Affected:</strong> Alpaquita:25: krb5, Alpaquita:stream: krb5</p> <p><strong>Affected:</strong> Alpaquita:25: krb5, Alpaquita:stream: krb5</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-40355 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0571 certfr-2026-avi-0571 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0571 https://cve.radiocsirt.org/vuln/euvd-2026-364782 EUVD-2026-364782 https://cve.radiocsirt.org/vuln/euvd-2026-364782 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40355 <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.</p> <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40355 https://cve.radiocsirt.org/vuln/ghsa-8qgv-wm66-hrmc <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.</p> <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.</p> https://cve.radiocsirt.org/vuln/ghsa-8qgv-wm66-hrmc https://cve.radiocsirt.org/vuln/icsa-26-209-04 <p>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).</p> <p>Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.</p> <p>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).</p> <p>Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.</p> https://cve.radiocsirt.org/vuln/icsa-26-209-04 https://cve.radiocsirt.org/vuln/msrc_cve-2026-40355 msrc_CVE-2026-40355 https://cve.radiocsirt.org/vuln/msrc_cve-2026-40355 https://cve.radiocsirt.org/vuln/oesa-2026-2257 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: krb5, openEuler:24.03-LTS-SP3: krb5, openEuler:20.03-LTS-SP4: krb5, openEuler:22.03-LTS-SP4: krb5, openEuler:24.03-LTS: krb5</p> <p>Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Security Fix(es):</p> <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.(CVE-2026-40355)</p> <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.(CVE-2026-40356)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: krb5, openEuler:24.03-LTS-SP3: krb5, openEuler:20.03-LTS-SP4: krb5, openEuler:22.03-LTS-SP4: krb5, openEuler:24.03-LTS: krb5</p> <p>Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Security Fix(es):</p> <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.(CVE-2026-40355)</p> <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.(CVE-2026-40356)</p> https://cve.radiocsirt.org/vuln/oesa-2026-2257 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10729-1 <p>krb5-1.22.2-3.1 on GA media</p> <p>krb5-1.22.2-3.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10729-1 https://cve.radiocsirt.org/vuln/rhsa-2026:12220 <p>krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read</p> <p>krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read</p> https://cve.radiocsirt.org/vuln/rhsa-2026:12220 https://cve.radiocsirt.org/vuln/rlsa-2026:19145 <p><strong>Affected:</strong> Rocky Linux:10: krb5</p> <p>Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).</p> <p>Security Fix(es):</p> <p>* krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356)</p> <p>* krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:10: krb5</p> <p>Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).</p> <p>Security Fix(es):</p> <p>* krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356)</p> <p>* krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:19145 https://cve.radiocsirt.org/vuln/ssa-019113 <p>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).</p> <p>Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.</p> <p>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).</p> <p>Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.</p> https://cve.radiocsirt.org/vuln/ssa-019113 https://cve.radiocsirt.org/vuln/suse-su-2026:1816-1 <p>Security update for krb5</p> <p>Security update for krb5</p> https://cve.radiocsirt.org/vuln/suse-su-2026:1816-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40355 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: krb5, Ubuntu:24.04:LTS: krb5, Ubuntu:25.10: krb5, Ubuntu:26.04:LTS: krb5</p> <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: krb5, Ubuntu:24.04:LTS: krb5, Ubuntu:25.10: krb5, Ubuntu:26.04:LTS: krb5</p> <p>In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40355 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1290 <p>Ein Angreifer kann mehrere Schwachstellen in MIT Kerberos ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MIT Kerberos ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1290