7.1
Élevée
CVE-2026-107778 MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows…
Description
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| krb5 1.22 | premières → 1.22.2 | Pas de correctif indiqué |
Autres CVE de krb5
Les 4 CVE de krb5 →
CVE-2026-107708
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that…
6.9
Moyenne
CVE-2019-14844
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could…
7.5
Élevée
CVE-2017-7562
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of…
6.5
Moyenne