Red Hat Security Advisory

RHSA-2026:80481

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images krb5-1.22.2-10.3.hum1@src, krb5-devel-1.22.2-10.3.hum1@aarch64, krb5-devel-1.22.2-10.3.hum1@s390x +25

Fixes 2 records

TI-2026-69755 CVE-2026-107778

NULL pointer dereference in MIT krb5 lets clients crash services

LOW 32

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00424 Published 2026-10-08 Partial fix CWE-476

TI-2026-69754 CVE-2026-107708

NULL pointer dereference in MIT krb5 KDC lets trusted KDCs crash it

LOW 31

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00521 Published 2026-10-08 Partial fix CWE-476