Most recent entries from all

ALSA-2026:16799 — Important: krb5 security update

Affected: AlmaLinux:8: krb5-devel, AlmaLinux:8: krb5-libs, AlmaLinux:8: krb5-pkinit, AlmaLinux:8: krb5-server, AlmaLinux:8: krb5-server-ldap, AlmaLinux:8: krb5-workstation, AlmaLinux:8: libkadm5

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es):

* krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356) * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-12848

BELL-CVE-2026-40356

Affected: Alpaquita:25: krb5, Alpaquita:stream: krb5

certfr-2026-avi-0571 — De multiples vulnérabilités ont été découvertes dans Microsoft Azure. Elles permettent à un attaquant de provoquer un p…

certfr-2026-avi-0571

EUVD-2026-293280

fkie_cve-2026-40356

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.

GHSA-f7p3-6rhj-p7jv

msrc_CVE-2026-40356 — In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an applic…

msrc_CVE-2026-40356

OESA-2026-2257 — krb5 security update

Affected: openEuler:24.03-LTS-SP1: krb5, openEuler:24.03-LTS-SP3: krb5, openEuler:20.03-LTS-SP4: krb5, openEuler:22.03-LTS-SP4: krb5, openEuler:24.03-LTS: krb5

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Security Fix(es):

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.(CVE-2026-40355)

openSUSE-SU-2026:10729-1 — krb5-1.22.2-3.1 on GA media

krb5-1.22.2-3.1 on GA media

RHSA-2026:12220 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read

RLSA-2026:19145 — Important: krb5 security update

Affected: Rocky Linux:10: krb5

Security Fix(es):

* krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356)

* krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1816-1 — Security update for krb5

Security update for krb5

UBUNTU-CVE-2026-40356

Affected: Ubuntu:22.04:LTS: krb5, Ubuntu:24.04:LTS: krb5, Ubuntu:25.10: krb5, Ubuntu:26.04:LTS: krb5

WID-SEC-W-2026-1290 — MIT Kerberos: Mehrere Schwachstellen ermöglichen Denial of Service

Ein Angreifer kann mehrere Schwachstellen in MIT Kerberos ausnutzen, um einen Denial of Service Angriff durchzuführen.