Junglewise Threat Intelligence

CVE-2025-59089: latchset kdcproxy denial of service via unbounded TCP buffering

CVE-2025-59089 · Severity: medium · CVSS 5.9 · Published 2025-11-12

Technologies: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10. Vendors: Red Hat.

Executive brief

kdcproxy is a service used to proxy Kerberos authentication traffic over HTTP/HTTPS. A vulnerability exists where an attacker can force the proxy to connect to a malicious server that sends an endless stream of data. This can cause the proxy server to crash or become unresponsive by exhausting its memory and processing power, preventing legitimate users from logging in.

Technical details

kdcproxy fails to enforce bounds on TCP response lengths when communicating with upstream KDC servers. When receiving a response, the component copies the entire buffered stream into a new buffer on every recv() call, leading to quadratic memory allocation and excessive CPU usage. Furthermore, kdcproxy continues to accept data chunks as long as the total length does not exactly match the length specified in the response header, even if the data exceeds the maximum Kerberos message size. An attacker can exploit this via Server-Side Request Forgery (SSRF) or by controlling a KDC to send unbounded data for up to 12 seconds, potentially causing an accept queue overflow and denying service to legitimate clients. This issue is addressed in kdcproxy version 1.1.0.

Affected products

  • latchset kdcproxy < 1.1.0
  • Red Hat Red Hat Enterprise Linux 7 python-kdcproxy < 0.3.2-3.el7_9.3
  • Red Hat Red Hat Enterprise Linux 8 python-kdcproxy < 1.0.0-19.el8_10
  • Red Hat Red Hat Enterprise Linux 9.6 EUS python-kdcproxy < 1.0.0-9.el9_6
  • Red Hat Red Hat Enterprise Linux 10 python-kdcproxy < 1.0.0-19.el10_1

Timeline

  • 2025-11-12: disclosed
  • 2025-11-12: advisory
  • 2025-11-12: patched

References

Related threats