CVE-2026-119079

Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding

decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112322

Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup

clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112323

Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112321

Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112320

Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching

The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112319

Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation

The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112317

Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path

krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112318

Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers

The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112316

Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failure

xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112315

Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failure

The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-13732

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cost Management On Premise Enterprise Linux Enterprise Linux Eus and 10 more

CVE-2026-115456

Gcc: out-of-bounds read in std::from_chars

A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Gcc Red Hat Redhat

Products

Gcc Enterprise Linux Enterprise Linux and 6 more

CVE-2026-115455

Gcc: stack overflow in std::bitset on libstdc++

A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gcc Red Hat Redhat

Products

Gcc Enterprise Linux Enterprise Linux and 5 more

CVE-2026-114691

Gcc: integer wrap in `std

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gcc Red Hat Redhat

Products

Gcc Enterprise Linux Enterprise Linux and 6 more

CVE-2026-114690

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Gcc Red Hat Redhat

Products

Gcc Enterprise Linux Enterprise Linux and 6 more

CVE-2026-124745

Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory

A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Busybox Red Hat Redhat

Products

Busybox Enterprise Linux Enterprise Linux and 3 more

CVE-2026-126831

Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames

A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Hardened Images and 2 more

CVE-2026-42784

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat Sequoia-pgp

Products

Enterprise Linux Ansible Automation Platform Ansible Automation Platform Developer and 15 more

CVE-2026-112314

Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries

clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-124746

Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound

A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Busybox Red Hat Redhat

Products

Busybox Enterprise Linux Enterprise Linux and 3 more