7.1
High
CVE-2026-107778 MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows…
Description
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| krb5 1.22 | earliest → 1.22.2 | No fix stated |
References
- Pull Request #1511 github.com
- Patch Commit github.com
- github.com github.com
- github.com github.com
- github.com github.com
- VulnCheck Advisory: MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred() www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of krb5
The 4 CVEs of krb5 →
CVE-2026-107708
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that…
6.9
Medium
CVE-2019-14844
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could…
7.5
High
CVE-2017-7562
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of…
6.5
Medium