Red Hat Security AdvisoryRHSA-2026:16799
krb5 security update
Released 2026-05-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS (v. 8) krb5-1.18.2-34.el8_10, krb5-devel-1.18.2-34.el8_10, krb5-libs-1.18.2-34.el8_10 +5
Fixes 2 records
Priority HIGH 66
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00645 · Published 2026-04-28 · Partial fix · 1.22.3 CWE-476
Priority LOW 34
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00604 · Published 2026-04-28 · Partial fix · 1.22.3 CWE-191
