Quick answers
- Is CVE-2026-119079 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-119079 being exploited in the wild.
- How severe is CVE-2026-119079?
- High severity, with a CVSS score of 7.5, published 9 November 2026.
- Which products and versions are affected?
- Mit Kerberos 5 1.11 and later.
- Is there a fix for CVE-2026-119079?
- No fixed version is recorded yet. Restrict incoming TCP traffic on port 88 to trusted internal networks using firewall rules; this prevents untrusted hosts from sending malicious requests to the KDC. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-119079 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-119079?
- Check whether you run Mit Kerberos 5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict incoming TCP traffic on port 88 to trusted internal networks using firewall rules; this prevents untrusted hosts from sending malicious requests to the KDC.
Technical details
The decode_sequence_of() function in lib/krb5/asn.1/asn1_encode.c has quadratic behavior when processing SEQUENCE OF fields with many elements, allowing an unauthenticated attacker to send AS-REQ or TGS-REQ messages over TCP with large element counts to cause CPU exhaustion in the KDC. The vulnerability (CWE-408) is reachable over the network without authentication or user interaction, directly impacting KDC availability.
Affected products
- MIT Kerberos 5 1.11 and later
Timeline
- 2026-11-09: disclosed