Read the docs
TI-2026-69755 Aliases CVE-2026-107778

NULL pointer dereference in MIT krb5 lets clients crash services

Priority LOW 32CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

MIT krb5 through 1.22.2 contains a NULL pointer dereference (CWE-476) in make_cred_list(). An authenticated Kerberos client sends forwarded credentials with mismatched KRB-CRED arrays over the network, which crashes GSS-API acceptor services and causes denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00424 36th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
moos-ivpkrb5up to 1.22.2—No fix listedCNA
  • krb5 Vendormoos-ivp Affected up to 1.22.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for MIT krb5. Red Hat fixes Red Hat Hardened Images in RHSA-2026:80481, while Red Hat Enterprise Linux 6 has no fix planned, and Red Hat Enterprise Linux 7, 8, 9 and 10 and Red Hat OpenShift AI (RHOAI) are affected without a listed fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Red Hat 1 advisory

  • RHSA-2026:80481 Released 2026-10-11 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images krb5-1.22.2-10.3.hum1@src, krb5-devel-1.22.2-10.3.hum1@aarch64, krb5-devel-1.22.2-10.3.hum1@s390x +25

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat Hardened ImagesFixed RHSA-2026:80481
Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107778
  2. 2026-10-09 CISA SSVC decision points changed
  3. 2026-10-09 Priority changed: MEDIUM → LOW
  4. 2026-10-13 Fix available: RHSA-2026:80481 · Red Hat
  5. 2026-10-13 Fix available: Red Hat Hardened Images · Red Hat
  6. 2026-10-30 Affected versions changed · Red Hat
  7. 2026-11-06 Affected versions changed · Red Hat

References

Patch 3

Other 2

  • TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
  • TI-2024-17421 Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. CVSS 3.1HIGH 7.5
  • TI-2001-00539 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows… CVSS 2.0HIGH 10.0
  • TI-2026-29130 NULL pointer dereference in moos-ivp Kerberos 5 CVSS 3.1HIGH 7.5
  • TI-2007-00929 The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass… CVSS 2.0HIGH 10.0
  • TI-2011-00268 The process_chpw_request function in schpw.c in the password-changing functionality in… CVSS 2.0HIGH 10.0
See all 176 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences