Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 150

Export CSV
CVE-2007-5894

krb5: ftpd - use of uninitialized variables

The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.

CVSS 2.0 · 9.3 Critical EPSS 3.3% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2026-40355

krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2022-42898

krb5: integer overflow vulnerabilities in PAC parsing

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

CVSS 3.1 · 8.8 High EPSS 6.9% KEV · Not listed
Vendors
Heimdal Project Mit Redhat and 1 more
Products
Heimdal Kerberos 5 Enterprise Linux and 7 more
CVE-2021-37750

krb5: NULL pointer dereference in process_tgs_req() in kdc/do_tgs_req.c via a FAST inner body that lacks server field

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Fedoraproject Mit and 3 more
Products
Debian Linux Fedora Kerberos 5 and 3 more
CVE-2021-36222

krb5: Sending a request containing PA-ENCRYPTED-CHALLENGE padata element without using FAST could result in NULL dereference in KDC which leads to DoS

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

CVSS 3.1 · 7.5 High EPSS 10.5% KEV · Not listed
Vendors
Debian Mit Netapp and 2 more
Products
Debian Linux Kerberos 5 Active Iq Unified Manager and 5 more
CVE-2020-28196

krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Fedoraproject Mit Netapp and 2 more
Products
Fedora Kerberos 5 Active Iq Unified Manager and 10 more
CVE-2026-107708

MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2026-107778

MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2024-37371

krb5: GSS message token handling

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

CVSS 3.1 · 9.1 Critical EPSS 1.9% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos 5 Enterprise Linux and 6 more
CVE-2024-37370

krb5: GSS message token handling

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux Rhel Aus and 5 more
CVE-2026-40356

krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2007-5971

krb5: double free in gssapi lib

Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Mit Redhat
Products
Mac Os X Mac Os X Server Kerberos 5 and 1 more
CVE-2008-0062

krb5: uninitialized pointer use in krb5kdc

KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.

CVSS 3.1 · 9.8 Critical EPSS 10.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2007-5972

krb5: double free in kdb lib

Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors. NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key.

CVSS 2.0 · 9.0 Critical EPSS 2.7% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2007-5901

krb5: use-after-free in gssapi lib

Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Mit Redhat
Products
Mac Os X Mac Os X Server Kerberos 5 and 1 more
CVE-2007-5902

krb5: integer overflow in rpc lib

Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.

CVSS 2.0 · 10.0 Critical EPSS 5.9% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2008-0063

krb5: possible leak of sensitive data from krb5kdc using krb4 request

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Mac Os X Mac Os X Server Ubuntu Linux and 10 more
CVE-2007-3999

krb5 RPC library buffer overflow

Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.

CVSS 2.0 · 10.0 Critical EPSS 11.0% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2007-2798

krb5 kadmind buffer overflow

Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.

CVSS 2.0 · 9.0 Critical EPSS 7.5% KEV · Not listed
Vendors
Canonical Debian Mit and 1 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 1 more
CVE-2007-3149

Local authentication bypass in sudo

sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Mit Todd Miller
Products
Kerberos 5 Sudo