Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 176

Export CSV
CVE-2026-107708

MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2026-107778

MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2024-37371

krb5: GSS message token handling

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

CVSS 3.1 · 9.1 Critical EPSS 1.9% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos 5 Enterprise Linux and 6 more
CVE-2024-37370

krb5: GSS message token handling

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux Rhel Aus and 5 more
CVE-2026-40356

krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2009-3295

krb5: KDC denial of service in cross-realm referral processing (MITKRB5-SA-2009-003)

The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.

CVSS 2.0 · 5.0 Medium EPSS 40.3% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2009-0847

krb5: incorrect length check inside ASN.1 decoder (MITKRB5-SA-2009-001)

The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic.

CVSS 2.0 · 4.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Mit
Products
Kerberos
CVE-2009-4212

krb: KDC integer overflows in AES and RC4 decryption routines (MITKRB5-SA-2009-004)

Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid.

CVSS 2.0 · 10.0 Critical EPSS 7.6% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos Kerberos 5 Enterprise Linux and 1 more
CVE-2008-0948

krb5: incorrect handling of high-numbered file descriptors in RPC library

Buffer overflow in the RPC library (lib/rpc/rpc_dtablesize.c) used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.2.2, and probably other versions before 1.3, when running on systems whose unistd.h does not define the FD_SETSIZE macro, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering a large number of open file descriptors.

CVSS 2.0 · 9.3 Critical EPSS 7.3% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2008-0947

krb5: file descriptor array overflow in RPC library

Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors.

CVSS 2.0 · 10.0 Critical EPSS 8.8% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2009-0844

krb5: buffer over-read in SPNEGO GSS-API mechanism (MITKRB5-SA-2009-001)

The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.

CVSS 2.0 · 5.8 Medium EPSS 4.3% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos Kerberos 5 Enterprise Linux
CVE-2008-0062

krb5: uninitialized pointer use in krb5kdc

KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.

CVSS 3.1 · 9.8 Critical EPSS 10.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2007-5972

krb5: double free in kdb lib

Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors. NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key.

CVSS 2.0 · 9.0 Critical EPSS 2.7% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2008-0063

krb5: possible leak of sensitive data from krb5kdc using krb4 request

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Mac Os X Mac Os X Server Ubuntu Linux and 10 more
CVE-2009-0845

krb5: NULL pointer dereference in GSSAPI SPNEGO (MITKRB5-SA-2009-001)

The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token.

CVSS 2.0 · 5.0 Medium EPSS 5.6% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos Kerberos 5 Enterprise Linux
CVE-2007-4743

krb5 incomplete fix for CVE-2007-3999

The original patch for CVE-2007-3999 in svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and other applications that use krb5, does not correctly check the buffer length in some environments and architectures, which might allow remote attackers to conduct a buffer overflow attack.

CVSS 2.0 · 10.0 Critical EPSS 4.6% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2007-4000

krb5 kadmind uninitialized pointer

The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.

CVSS 2.0 · 8.5 High EPSS 6.1% KEV · Not listed
Vendors
Fedoraproject Mit Redhat
Products
Fedora Kerberos 5 Enterprise Linux
CVE-2007-3149

Local authentication bypass in sudo

sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Mit Todd Miller
Products
Kerberos 5 Sudo
CVE-2007-5971

krb5: double free in gssapi lib

Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Mit Redhat
Products
Mac Os X Mac Os X Server Kerberos 5 and 1 more
CVE-2007-2798

krb5 kadmind buffer overflow

Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.

CVSS 2.0 · 9.0 Critical EPSS 7.5% KEV · Not listed
Vendors
Canonical Debian Mit and 1 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 1 more