CVE-2026-40356
CVE-2026-40356
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
CVSS 5.9 · Medium · EPSS 0.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
kerberos 5
- Versions
- ≥ 1.18, < 1.22.3: Affected (custom)
Update to 1.22.3
krb5 Debian:12
- Versions
- 1.20.1-2
- 1.20.1-2+deb12u1
- 1.20.1-2+deb12u2
- 1.20.1-2+deb12u3
- 1.20.1-2+deb12u4
- Affected ranges
- ECOSYSTEM: < 1.20.1-2+deb12u5
Update to 1.20.1-2+deb12u5
krb5 Debian:13
- Versions
- 1.21.3-5
- Affected ranges
- ECOSYSTEM: < 1.21.3-5+deb13u1
Update to 1.21.3-5+deb13u1
krb5 Debian:14
- Versions
- 1.21.3-5
- 1.22.1-1
- 1.22.1-2
- Affected ranges
- ECOSYSTEM: < 1.22.1-2.1
Update to 1.22.1-2.1
krb5 Ubuntu:22.04:LTS
- Versions
- 1.18.3-6
- 1.18.3-7
- 1.19.2-0ubuntu1
- 1.19.2-1
- 1.19.2-2
- 1.19.2-2ubuntu0.1
- 1.19.2-2ubuntu0.2
- 1.19.2-2ubuntu0.3
- 1.19.2-2ubuntu0.4
- 1.19.2-2ubuntu0.5
- 1.19.2-2ubuntu0.6
- 1.19.2-2ubuntu0.7
- Affected ranges
- ECOSYSTEM: < 1.19.2-2ubuntu0.8
Update to 1.19.2-2ubuntu0.8
krb5 Ubuntu:24.04:LTS
- Versions
- 1.20.1-3ubuntu1
- 1.20.1-5build1
- 1.20.1-6ubuntu1
- 1.20.1-6ubuntu2
- 1.20.1-6ubuntu2.1
- 1.20.1-6ubuntu2.2
- 1.20.1-6ubuntu2.3
- 1.20.1-6ubuntu2.4
- 1.20.1-6ubuntu2.5
- 1.20.1-6ubuntu2.6
- Affected ranges
- ECOSYSTEM: < 1.20.1-6ubuntu2.7
Update to 1.20.1-6ubuntu2.7
krb5 Ubuntu:25.10
- Versions
- 1.21.3-4ubuntu2
- 1.21.3-5ubuntu1
- 1.21.3-5ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
krb5 Ubuntu:26.04:LTS
- Versions
- 1.21.3-5ubuntu2
- 1.22.1-2
- 1.22.1-2ubuntu2
- 1.22.1-2ubuntu3
- 1.22.1-2ubuntu4
- Affected ranges
- ECOSYSTEM: < 1.22.1-2ubuntu4.1
Update to 1.22.1-2ubuntu4.1