AZL-85238 CVE-2026-40356 affecting package krb5 for versions less than 1.21.3-4

🗓️ 28 Apr 2026 07:16:03Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Integer underflow in MIT krb5 before 1.22.3 via gss_accept_sec_context causes OOB read and DoS.

Reporter	Title	Published	Views	Family All 134
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System 1.0 is affected by multiple vulnerabilities	10 Jun 202607:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	19 Jun 202608:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images	29 Jun 202609:15	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Application Gateway	7 Jul 202606:11	–	ibm
ATTACKERKB	CVE-2026-40356	28 Apr 202600:00	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2026-1680)	20 May 202600:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0118: krb5 (ALINUX3-SA-2026:0118)	25 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : krb5 (ALSA-2026:16799)	13 May 202600:00	–	nessus
Tenable Nessus	CentOS 9 : krb5-1.21.1-10.el9	4 May 202600:00	–	nessus
Tenable Nessus	Debian dla-4603 : krb5-admin-server - security update	29 May 202600:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-40356

29 Aug 2026 05:27Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.15.9 - 7.5

EPSS0.00604

SSVC