Red Hat Security AdvisoryRHSA-2026:19357
krb5 security update
Released 2026-05-19 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) krb5-devel-1.21.1-10.el9_8
- Red Hat Enterprise Linux BaseOS (v. 9) krb5-1.21.1-10.el9_8, krb5-libs-1.21.1-10.el9_8, krb5-pkinit-1.21.1-10.el9_8 +5
Fixes 2 records
Priority HIGH 66
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00645 · Published 2026-04-28 · Partial fix · 1.22.3 CWE-476
Priority LOW 34
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00604 · Published 2026-04-28 · Partial fix · 1.22.3 CWE-191
