Security update for krb5

This update for krb5 fixes the following issues: CVE-2026-107708: Denial of Service via malformed PAC in S4U2Proxy requests bsc1284816. CVE-2026-107778: Denial of Service via crafted forwarded credentials bsc1284817. Patch Instructions: To install this SUSE update use the SUSE recommended...

PT-2026-122060

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5 authenticate In krb5 authenticate, out len is calculated to determine available headroom in response buf for the incoming Kerberos AP-REP token. However, when SMB2 SESSION SETUP is...

OESA-2026-4494 krb5 security update

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Security Fixes: MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows...

OESA-2026-4493 krb5 security update

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Security Fixes: MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns...

OESA-2026-4492 krb5 security update

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Security Fixes: MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns...

OESA-2026-4491 krb5 security update

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Security Fixes: MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns...

CLSA-2026-1792593112 krb5: Fix of 2 CVEs

CVE-2026-40355: NULL pointer dereference in parsenegomessage - CVE-2026-40356: integer underflow and out-of-bounds read in parsemessage...

CLSA-2026-1792592896 krb5: Fix of 2 CVEs

CVE-2026-40355: NULL pointer dereference in parsenegomessage - CVE-2026-40356: integer underflow and out-of-bounds read in parsemessage...

Linux Distros Unpatched Vulnerability : CVE-2026-107778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services ...

CVE-2026-80924

A flaw was found in the Linux kernel's Kerberos 5 krb5 cryptography module. When handling derived key buffers, the cryptokrb5prepareencryption and cryptokrb5preparechecksum functions incorrectly use kfree instead of kfreesensitive for memory deallocation. This oversight leaves sensitive key...

CLSA-2026-1792097614 Fix CVE(s): CVE-2026-107778

SECURITY UPDATE: NULL pointer dereference in krb5rdcred - debian/patches/CVE-2026-107778.patch: reject a KRB-CRED message whose encrypted ticket-info list is shorter than its tickets list in src/lib/krb5/krb/rdcred.c makecredlist; backport of upstream commit 48afa9abb89ab2176bb20624d87d010b9984fc...

Astra Linux – Vulnerability in krb5

In MIT Kerberos 5 also known as krb5, prior to version 1.22.3, there was a NULL pointer dereferencing issue when an application called gssacceptseccontext on a system where the NegoEx mechanism was registered in /etc/gss/mech. An unauthenticated remote attacker could trigger this issue, causing t...

ROOT-OS-DEBIAN-13-CVE-2026-11850 CVE-2026-11850 in krb5 - Patched by Root

Root has patched CVE-2026-11850 in the krb5 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-107778 CVE-2026-107778 in krb5 - Patched by Root

Root has patched CVE-2026-107778 in the krb5 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-11850 CVE-2026-11850 in krb5 - Patched by Root

Root has patched CVE-2026-11850 in the krb5 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2024-26458 CVE-2024-26458 in krb5 - Patched by Root

Root has patched CVE-2024-26458 in the krb5 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2018-5709 CVE-2018-5709 in krb5 - Patched by Root

Root has patched CVE-2018-5709 in the krb5 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2024-26461 CVE-2024-26461 in krb5 - Patched by Root

Root has patched CVE-2024-26461 in the krb5 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-107778 CVE-2026-107778 in krb5 - Patched by Root

Root has patched CVE-2026-107778 in the krb5 package for Root:Debian:12. Multiple fixed versions available...

UBUNTU-CVE-2026-107778

MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...