CVE-2026-71200

{}

{}

{}

{"acknowledgement": "This issue was discovered by Ada Logics, Erin Liman, and Found by AISLE in partnership with Red Hat.", "bugzilla": {"description": "krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request", "id": "2478447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478447"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["If a KDC is configured to allow PKINIT authentication, an unauthenticated attacker can trigger a null pointer dereference, causing the process to terminate."], "mitigation": {"lang": "en:us", "value": "Disable PKINIT on the KDC if certificate-based authentication is not required, or restrict network access to the KDC service using firewall rules.\n1. Disabling PKINIT:\nEdit `/var/kerberos/krb5kdc/kdc.conf` and comment out or remove the `pkinit_identity` and `pkinit_anchors` directives within the realm configuration:\n```\n# pkinit_identity = FILE:/etc/krb5kdc/kdc.pem,/etc/krb5kdc/kdckey.pem\n# pkinit_anchors = FILE:/etc/krb5kdc/cacert.pem\n```\nApply the changes by restarting the service:\n```\nsystemctl restart krb5kdc.service\n```\n2. Restricting Network Access:\nIf PKINIT cannot be disabled, restrict network access to port 88 (UDP/TCP) to trusted client subnets using firewalld:\n```\nfirewall-cmd --permanent --zone=internal --add-service=kerberos\nfirewall-cmd --permanent --zone=internal --add-source=192.168.1.0/24\nfirewall-cmd --reload\n```\nCaveats:\nDisabling PKINIT prevents users and services from using smart cards or X.509 certificate pre-authentication. Restricting network access prevents unlisted subnets from obtaining Kerberos tickets.\nWarning: Restarting `krb5kdc.service` will cause a momentary interruption to active authentication requests."}, "name": "CVE-2026-71200", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-09T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71200\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71200"], "statement": "This vulnerability is rated as Important because an unauthenticated remote attacker can crash the Kerberos Key Distribution Center (KDC) daemon, leading to a complete denial of service across the authentication realm. In default Red Hat Enterprise Linux configurations, PKINIT pre-authentication is not activated; exploitation strictly requires the administrator to have explicitly enabled PKINIT via `pkinit_identity` and `pkinit_anchors` in the KDC configuration. Deployments operating with standard Kerberos authentication mechanisms and without PKINIT configured are unaffected.", "threat_severity": "Important"}

{"created": "2026-11-12T03:45:21.913299+00:00", "updated": "2026-11-13T23:45:21.830509+00:00", "vendors": []}