Executive brief
MIT Kerberos 5 is a widely used authentication protocol that secures logins for millions of users and enterprise systems like Microsoft Active Directory. A vulnerability in its NegoEx parsing component allows an unauthenticated remote attacker to crash the authentication service by sending a specially crafted network packet. This results in a denial-of-service, preventing users from logging into affected systems and disrupting business operations.
Technical details
A NULL pointer dereference exists in the NegoEx parsing logic of MIT Kerberos 5 (krb5). The vulnerability is located in the parse_nego_message() function within src/lib/gssapi/spnego/negoex_util.c, where the return value of a vector_base() call is dereferenced without a NULL check. An unauthenticated remote attacker can trigger this flaw by sending a crafted NegoEx message to an application calling gss_accept_sec_context() on a system where NegoEx is registered. This results in a process crash (DoS). The issue is fixed in version 1.22.3.
Affected products
- MIT Kerberos 5 1.18.0 to 1.22.2
Timeline
- 2026-04-27: disclosed: Initial disclosure by researcher Cem Onat Karagun
- 2026-04-28: advisory: NVD and MITRE publish CVE-2026-40355
- 2026-04-28: patched: Upstream fix committed to krb5 repository