Read the docs
TI-2026-29131 Aliases CVE-2026-40356GHSA-f7p3-6rhj-p7jv

Integer underflow in moos-ivp Kerberos 5

Priority LOW 34CWE-191Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 20 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-191 and the CVSS impact.

Summary

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00604 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Kerberos 5 (MIT): 1.22.3Red Hat: 21 advisoriesRed Hat: 20 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
moos-ivpKerberos 51.18 to before 1.22.31.22.3Patch availableCNA
  • Kerberos 5 Vendormoos-ivp Affected 1.18 to before 1.22.3 Fixed in 1.22.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*1.18.0 – 1.22.2Vulnerablemoos-ivp
  • cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:* Versions 1.18.0 – 1.22.2 Vulnerable ·moos-ivp

Remediation

  • Fix · CNA Kerberos 5 (MIT) Fixed in 1.22.3

Red Hat 21 advisories

  • RHSA-2026:82888 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82857 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 18 more Red Hat advisories
  • RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:72502 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:43692 Released 2026-07-22 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.6 registry.redhat.io/oadp/oadp-velero-rhel9
  • RHSA-2026:29197 Released 2026-06-24 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:24683 Released 2026-06-09 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) krb5-devel-1.21.1-8.el9_6.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) krb5-1.21.1-8.el9_6.2, krb5-libs-1.21.1-8.el9_6.2, krb5-pkinit-1.21.1-8.el9_6.2 +4
  • RHSA-2026:24686 Released 2026-06-09 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) krb5-devel-1.21.1-2.el9_4.5
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) krb5-1.21.1-2.el9_4.5, krb5-libs-1.21.1-2.el9_4.5, krb5-pkinit-1.21.1-2.el9_4.5 +4
  • RHSA-2026:24685 Released 2026-06-09 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) krb5-devel-1.20.1-9.el9_2.6
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) krb5-1.20.1-9.el9_2.6, krb5-libs-1.20.1-9.el9_2.6, krb5-pkinit-1.20.1-9.el9_2.6 +4
  • RHSA-2026:22634 Released 2026-06-02 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2026:21275 Released 2026-05-27 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.1 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:19357 Released 2026-05-19 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream (v. 9) krb5-devel-1.21.1-10.el9_8
    • Red Hat Enterprise Linux BaseOS (v. 9) krb5-1.21.1-10.el9_8, krb5-libs-1.21.1-10.el9_8, krb5-pkinit-1.21.1-10.el9_8 +5
  • RHSA-2026:19145 Released 2026-05-19 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux AppStream (v. 10) krb5-devel-1.21.3-10.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) krb5-1.21.3-10.el10_2, krb5-libs-1.21.3-10.el10_2, krb5-pkinit-1.21.3-10.el10_2 +5
  • RHSA-2026:16799 Released 2026-05-13 · Red Hat rating Important
    krb5 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) krb5-1.18.2-34.el8_10, krb5-devel-1.18.2-34.el8_10, krb5-libs-1.18.2-34.el8_10 +5
  • RHSA-2026:12220 Released 2026-04-30 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images krb5-1.22.2-7.hum1@src, krb5-devel-1.22.2-7.hum1@aarch64, krb5-devel-1.22.2-7.hum1@x86_64 +14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MIT Kerberos 5 1.22.3

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-29130 NULL pointer dereference in moos-ivp Kerberos 5Priority HIGH 66
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82888
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72502
OpenShift API for Data Protection 1.6Fixed RHSA-2026:43692
Red Hat Discovery 2Fixed RHSA-2026:29197
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:19145
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:19357
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:24685
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:24686
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:24683
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:19145
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:16799
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:19357
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:24685
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:24686
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:24683
Red Hat Hardened ImagesFixed RHSA-2026:12220
Red Hat Insights proxy 1.5Fixed RHSA-2026:22634
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Red Hat Update Infrastructure 5Fixed RHSA-2026:21275, RHSA-2026:58981
Not affected: 3 products
  • OpenShift API for Data Protection 1.6
  • Red Hat Hardened Images
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40356
  2. 2026-10-03 Alias added: GHSA-f7p3-6rhj-p7jv
  3. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  4. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  5. 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
  6. 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
  7. 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
  8. 2026-10-15 Fix available: RHSA-2026:82857 · Red Hat
  9. 2026-10-15 Fix available: RHSA-2026:82888 · Red Hat
  10. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat
  11. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

  • TI-2024-17421 Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. CVSS 3.1HIGH 7.5
  • TI-2001-00539 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows… CVSS 2.0HIGH 10.0
  • TI-2026-29130 NULL pointer dereference in moos-ivp Kerberos 5 CVSS 3.1HIGH 7.5
  • TI-2007-00929 The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass… CVSS 2.0HIGH 10.0
  • TI-2011-00268 The process_chpw_request function in schpw.c in the password-changing functionality in… CVSS 2.0HIGH 10.0
  • TI-2001-00245 Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary… CVSS 2.0HIGH 10.0
See all 138 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences