Read the docs
TI-2026-29130 Aliases CVE-2026-40355GHSA-8qgv-wm66-hrmc

NULL pointer dereference in moos-ivp Kerberos 5

Priority HIGH 66CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00645 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Kerberos 5 (MIT): 1.22.3Red Hat: 16 advisoriesRed Hat: 12 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
moos-ivpKerberos 51.18 to before 1.22.31.22.3Patch availableCNA
  • Kerberos 5 Vendormoos-ivp Affected 1.18 to before 1.22.3 Fixed in 1.22.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*1.18.0 – 1.22.2Vulnerablemoos-ivp
  • cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:* Versions 1.18.0 – 1.22.2 Vulnerable ·moos-ivp

Remediation

  • Fix · CNA Kerberos 5 (MIT) Fixed in 1.22.3

Red Hat 16 advisories

  • RHSA-2026:82888 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82857 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 13 more Red Hat advisories
  • RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:72502 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:29197 Released 2026-06-24 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:22634 Released 2026-06-02 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2026:21275 Released 2026-05-27 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.1 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:19357 Released 2026-05-19 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream (v. 9) krb5-devel-1.21.1-10.el9_8
    • Red Hat Enterprise Linux BaseOS (v. 9) krb5-1.21.1-10.el9_8, krb5-libs-1.21.1-10.el9_8, krb5-pkinit-1.21.1-10.el9_8 +5
  • RHSA-2026:19145 Released 2026-05-19 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream (v. 10) krb5-devel-1.21.3-10.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) krb5-1.21.3-10.el10_2, krb5-libs-1.21.3-10.el10_2, krb5-pkinit-1.21.3-10.el10_2 +5
  • RHSA-2026:16799 Released 2026-05-13 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) krb5-1.18.2-34.el8_10, krb5-devel-1.18.2-34.el8_10, krb5-libs-1.18.2-34.el8_10 +5
  • RHSA-2026:12220 Released 2026-04-30 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images krb5-1.22.2-7.hum1@src, krb5-devel-1.22.2-7.hum1@aarch64, krb5-devel-1.22.2-7.hum1@x86_64 +14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MIT Kerberos 5 1.22.3

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-29131 Integer underflow in moos-ivp Kerberos 5Priority LOW 34
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82888
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72502
Red Hat Discovery 2Fixed RHSA-2026:29197
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:19145
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:19357
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:19145
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:16799
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:19357
Red Hat Hardened ImagesFixed RHSA-2026:12220
Red Hat Insights proxy 1.5Fixed RHSA-2026:22634
Red Hat Update Infrastructure 5Fixed RHSA-2026:21275, RHSA-2026:58981
Not affected: 2 products
  • Red Hat Hardened Images
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40355
  2. 2026-10-03 Alias added: GHSA-8qgv-wm66-hrmc
  3. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  4. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  5. 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
  6. 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
  7. 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
  8. 2026-10-15 Fix available: RHSA-2026:82857 · Red Hat
  9. 2026-10-15 Fix available: RHSA-2026:82888 · Red Hat
  10. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat

References

Exploit 1

Patch 1

Advisory 1

  • TI-2024-17421 Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. CVSS 3.1HIGH 7.5
  • TI-2001-00539 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows… CVSS 2.0HIGH 10.0
  • TI-2007-00929 The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass… CVSS 2.0HIGH 10.0
  • TI-2011-00268 The process_chpw_request function in schpw.c in the password-changing functionality in… CVSS 2.0HIGH 10.0
  • TI-2001-00245 Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary… CVSS 2.0HIGH 10.0
  • TI-2002-01190 The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon… CVSS 2.0HIGH 10.0
See all 138 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences