p PatchFirst

PatchFirst · Latest vulnerabilities

krb5 vulnerabilities

Vulnerabilities published for krb5 in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-107778

    High · CVSS 7.1EPSS 0.42%No fix published

    MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()

    MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

    krb5Operating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-107708

    Medium · CVSS 6.9EPSS 0.52%No fix published

    MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

    MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

    krb5Operating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →