CVE-2026-40356
Fixed in a distro release EPSS <1%CVSS 5.9
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
Products: mit kerberos_5
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | krb5-devel | 1.21.3-10.el10_2 |
| AlmaLinux 10 | krb5-libs | 1.21.3-10.el10_2 |
| AlmaLinux 10 | krb5-pkinit | 1.21.3-10.el10_2 |
| AlmaLinux 10 | krb5-server | 1.21.3-10.el10_2 |
| AlmaLinux 10 | krb5-server-ldap | 1.21.3-10.el10_2 |
| AlmaLinux 10 | krb5-workstation | 1.21.3-10.el10_2 |
| AlmaLinux 10 | krb5-xrealmauthz | 1.21.3-10.el10_2 |
| AlmaLinux 10 | libkadm5 | 1.21.3-10.el10_2 |
| AlmaLinux 8 | krb5-devel | 1.18.2-34.el8_10 |
| AlmaLinux 8 | krb5-libs | 1.18.2-34.el8_10 |
| AlmaLinux 8 | krb5-pkinit | 1.18.2-34.el8_10 |
| AlmaLinux 8 | krb5-server | 1.18.2-34.el8_10 |
| AlmaLinux 8 | krb5-server-ldap | 1.18.2-34.el8_10 |
| AlmaLinux 8 | krb5-workstation | 1.18.2-34.el8_10 |
| AlmaLinux 8 | libkadm5 | 1.18.2-34.el8_10 |
| AlmaLinux 9 | krb5-devel | 1.21.1-10.el9_8 |
| AlmaLinux 9 | krb5-libs | 1.21.1-10.el9_8 |
| AlmaLinux 9 | krb5-pkinit | 1.21.1-10.el9_8 |
| AlmaLinux 9 | krb5-server | 1.21.1-10.el9_8 |
| AlmaLinux 9 | krb5-server-ldap | 1.21.1-10.el9_8 |
| AlmaLinux 9 | krb5-workstation | 1.21.1-10.el9_8 |
| AlmaLinux 9 | krb5-xrealmauthz | 1.21.1-10.el9_8 |
| AlmaLinux 9 | libkadm5 | 1.21.1-10.el9_8 |
| Amazon Linux 2023 | krb5-devel | 1.21.3-7.amzn2023.0.1 |
| Amazon Linux 2023 | krb5-libs | 1.21.3-7.amzn2023.0.1 |
| Amazon Linux 2023 | krb5-pkinit | 1.21.3-7.amzn2023.0.1 |
| Amazon Linux 2023 | krb5-server | 1.21.3-7.amzn2023.0.1 |
| Amazon Linux 2023 | krb5-server-ldap | 1.21.3-7.amzn2023.0.1 |
| Amazon Linux 2023 | krb5-workstation | 1.21.3-7.amzn2023.0.1 |
| Amazon Linux 2023 | libkadm5 | 1.21.3-7.amzn2023.0.1 |
| Debian 12 | krb5 | 1.20.1-2+deb12u5 |
| Debian 13 | krb5 | 1.21.3-5+deb13u1 |
| Debian 14 | krb5 | 1.22.1-2.1 |
| Red Hat Enterprise Linux 10.2 | krb5 | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-debuginfo | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-debugsource | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-devel | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-libs | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-libs-debuginfo | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-pkinit | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-pkinit-debuginfo | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-server | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-server-debuginfo | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-server-ldap | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-server-ldap-debuginfo | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-workstation | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-workstation-debuginfo | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-xrealmauthz | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | krb5-xrealmauthz-debuginfo | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | libkadm5 | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 10.2 | libkadm5-debuginfo | 0:1.21.3-10.el10_2 |
| Red Hat Enterprise Linux 8 | krb5 | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-debuginfo | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-debugsource | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-devel | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-devel-debuginfo | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-libs | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-libs-debuginfo | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-pkinit | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-pkinit-debuginfo | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-server | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-server-debuginfo | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-server-ldap | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-server-ldap-debuginfo | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-workstation | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | krb5-workstation-debuginfo | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | libkadm5 | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 8 | libkadm5-debuginfo | 0:1.18.2-34.el8_10 |
| Red Hat Enterprise Linux 9 | krb5 | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-debuginfo | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-debugsource | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-devel | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-libs | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-libs-debuginfo | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-pkinit | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-pkinit-debuginfo | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-server | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-server-debuginfo | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-server-ldap | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-server-ldap-debuginfo | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-workstation | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-workstation-debuginfo | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-xrealmauthz | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | krb5-xrealmauthz-debuginfo | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | libkadm5 | 0:1.21.1-10.el9_8 |
| Red Hat Enterprise Linux 9 | libkadm5-debuginfo | 0:1.21.1-10.el9_8 |
| Red Hat hummingbird 1 | krb5 | 0:1.22.2-7.hum1 |
| Red Hat hummingbird 1 | krb5-devel | 0:1.22.2-7.hum1 |
| Red Hat hummingbird 1 | krb5-libs | 0:1.22.2-7.hum1 |
| Red Hat hummingbird 1 | krb5-pkinit | 0:1.22.2-7.hum1 |
| Red Hat hummingbird 1 | krb5-server | 0:1.22.2-7.hum1 |
| Red Hat hummingbird 1 | krb5-server-ldap | 0:1.22.2-7.hum1 |
| Red Hat hummingbird 1 | krb5-tests | 0:1.22.2-7.hum1 |
| Red Hat hummingbird 1 | krb5-workstation | 0:1.22.2-7.hum1 |
| Red Hat hummingbird 1 | krb5-xrealmauthz | 0:1.22.2-7.hum1 |
| Red Hat rhel e4s 9.2 | krb5 | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-debuginfo | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-debugsource | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-devel | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-libs | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-libs-debuginfo | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-pkinit | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-pkinit-debuginfo | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-server | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-server-debuginfo | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-server-ldap | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-server-ldap-debuginfo | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-workstation | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | krb5-workstation-debuginfo | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | libkadm5 | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.2 | libkadm5-debuginfo | 0:1.20.1-9.el9_2.6 |
| Red Hat rhel e4s 9.4 | krb5 | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-debuginfo | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-debugsource | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-devel | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-libs | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-libs-debuginfo | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-pkinit | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-pkinit-debuginfo | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-server | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-server-debuginfo | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-server-ldap | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-server-ldap-debuginfo | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-workstation | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | krb5-workstation-debuginfo | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | libkadm5 | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel e4s 9.4 | libkadm5-debuginfo | 0:1.21.1-2.el9_4.5 |
| Red Hat rhel eus 9.6 | krb5 | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-debuginfo | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-debugsource | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-devel | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-libs | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-libs-debuginfo | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-pkinit | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-pkinit-debuginfo | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-server | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-server-debuginfo | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-server-ldap | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-server-ldap-debuginfo | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-workstation | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | krb5-workstation-debuginfo | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | libkadm5 | 0:1.21.1-8.el9_6.2 |
| Red Hat rhel eus 9.6 | libkadm5-debuginfo | 0:1.21.1-8.el9_6.2 |
| Rocky Linux 10 | krb5 | 0:1.21.3-10.el10_2 |
| Rocky Linux 8 | krb5 | 0:1.18.2-34.el8_10 |
| Rocky Linux 9 | krb5 | 0:1.21.1-10.el9_8 |
| SUSE Linux Enterprise Micro 5.3 | krb5 | 1.19.2-150400.3.21.1 |
| SUSE Linux Enterprise Micro 5.4 | krb5 | 1.19.2-150400.3.21.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | krb5 | 1.20.1-150600.11.19.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | krb5 | 1.20.1-150600.11.19.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | krb5 | 1.20.1-150600.11.19.1 |
| SUSE Linux Enterprise Server 16.0 | krb5 | 1.21.3-160000.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | krb5 | 1.20.1-150600.11.19.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | krb5 | 1.21.3-160000.3.1 |
| SUSE Linux Micro 6.2 | krb5 | 1.21.3-160000.3.1 |
| Ubuntu 22.04 LTS | krb5 | 1.19.2-2ubuntu0.8 |
| Ubuntu 24.04 LTS | krb5 | 1.20.1-6ubuntu2.7 |
| Ubuntu 25.10 | krb5 | no fix |
| Ubuntu 26.04 LTS | krb5 | 1.22.1-2ubuntu4.1 |
| openSUSE Leap 16.0 | krb5 | 1.21.3-160000.3.1 |
| openSUSE Tumbleweed | krb5 | 1.22.2-3.1 |