# CVE-2024-37371: MIT Kerberos 5 out-of-bounds read in GSS message token handling

Source: https://junglewise.ai/threats/cve-2024-37371-mit-kerberos-5-out-of-bounds-read-in-gss-message-token-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-06-28. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-37371 · Severity: critical · CVSS 9.1 · Published 2024-06-28

MIT Kerberos 5, a widely used authentication protocol for securing network communications, contains a vulnerability in how it handles security tokens. An unauthenticated attacker can send specially crafted messages to trigger memory errors, potentially leading to the exposure of sensitive information or causing a system crash. This impact can extend to various enterprise systems and industrial hardware, such as Siemens SIMATIC controllers, that rely on this library for secure access.

Technologies: [Mit Kerberos 5](https://junglewise.ai/threats/technologies/kerberos-5). Vendors: [Mit](https://junglewise.ai/threats/vendors/mit), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2024-37371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-37371 being exploited in the wild.

**How severe is CVE-2024-37371?** Critical severity, with a CVSS score of 9.1, published 28 June 2024.

**Which products and versions are affected?** Mit Kerberos 5 1.3 to 1.21.2; Siemens S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5.

**Is there a fix for CVE-2024-37371?** A patch was published on 2024-06-28: Fixed in krb5 version 1.21.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-37371 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-37371?** Check whether you run Mit Kerberos 5 or Siemens S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in MIT Kerberos 5 (krb5) within the GSS-API message token handling logic. The flaw is triggered when the library processes message tokens with invalid length fields, specifically within functions like gss_krb5int_unseal_token_v3() and kg_unseal_iov_token(). A remote, unauthenticated attacker can exploit this by sending malformed tokens over the network. Successful exploitation can result in unauthorized access to sensitive memory contents or a denial-of-service (DoS) condition via a crash. The vulnerability was introduced in version 1.3 and is fixed in version 1.21.3.

## Affected products

- MIT Kerberos 5 (krb5) 1.3 to 1.21.2
- Siemens S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5

## Timeline

- 2024-06-28: disclosed
- 2024-06-28: advisory
- 2024-06-28: patched: Fixed in krb5 version 1.21.3

## References

- [https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef](https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef)
- [https://web.mit.edu/kerberos/www/advisories/](https://web.mit.edu/kerberos/www/advisories/)
- [https://security.netapp.com/advisory/ntap-20241108-0009/](https://security.netapp.com/advisory/ntap-20241108-0009/)
- [https://security.netapp.com/advisory/ntap-20250124-0010/](https://security.netapp.com/advisory/ntap-20250124-0010/)
- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)

## Related threats

- [MIT Kerberos 5 denial of service in ASN.1 SEQUENCE OF decoding](https://junglewise.ai/threats/cve-2026-119079-decode-sequence-of-in-lib-krb5-asn-1-asn1-encode-c-in-mit)
- [MIT Kerberos 5 kadmind memory exhaustion in AUTH_GSSAPI](https://junglewise.ai/threats/cve-2026-112323-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit)
- [MIT Kerberos 5 denial of service in kadmind AUTH_GSSAPI cleanup](https://junglewise.ai/threats/cve-2026-112322-clean-client-in-lib-rpc-svc-auth-gssapi-c-in-mit-kerberos-5-aka)
- [MIT Kerberos memory exhaustion in AUTH_GSSAPI handler](https://junglewise.ai/threats/cve-2026-112321-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit)
- [MIT Kerberos 5 memory exhaustion via GSS-RPC authentication context leak](https://junglewise.ai/threats/cve-2026-112320-the-gss-rpc-transport-layer-in-mit-kerberos-5-aka-krb5-1-4-and)