# CVE-2026-40355: MIT Kerberos 5 NULL pointer dereference in NegoEx parsing

Source: https://junglewise.ai/threats/cve-2026-40355-mit-kerberos-5-null-pointer-dereference-in-negoex-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-40355 · Severity: medium · CVSS 5.9 · Published 2026-04-28

MIT Kerberos 5 is a widely used authentication protocol that secures logins for millions of users and enterprise systems like Microsoft Active Directory. A vulnerability in its NegoEx parsing component allows an unauthenticated remote attacker to crash the authentication service by sending a specially crafted network packet. This results in a denial-of-service, preventing users from logging into affected systems and disrupting business operations.

Technologies: [Mit Kerberos 5](https://junglewise.ai/threats/technologies/kerberos-5). Vendors: [Mit](https://junglewise.ai/threats/vendors/mit).

## Quick answers

**Is CVE-2026-40355 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40355 being exploited in the wild.

**How severe is CVE-2026-40355?** Medium severity, with a CVSS score of 5.9, published 28 April 2026.

**Which products and versions are affected?** Mit Kerberos 5 1.18.0 to 1.22.2.

**Is there a fix for CVE-2026-40355?** A patch was published on 2026-04-28: Upstream fix committed to krb5 repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40355 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40355?** Check whether you run Mit Kerberos 5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference exists in the NegoEx parsing logic of MIT Kerberos 5 (krb5). The vulnerability is located in the parse_nego_message() function within src/lib/gssapi/spnego/negoex_util.c, where the return value of a vector_base() call is dereferenced without a NULL check. An unauthenticated remote attacker can trigger this flaw by sending a crafted NegoEx message to an application calling gss_accept_sec_context() on a system where NegoEx is registered. This results in a process crash (DoS). The issue is fixed in version 1.22.3.

## Affected products

- MIT Kerberos 5 1.18.0 to 1.22.2

## Timeline

- 2026-04-27: disclosed: Initial disclosure by researcher Cem Onat Karagun
- 2026-04-28: advisory: NVD and MITRE publish CVE-2026-40355
- 2026-04-28: patched: Upstream fix committed to krb5 repository

## References

- [https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html](https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html)
- [https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f](https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f)
- [https://web.mit.edu/kerberos/advisories/](https://web.mit.edu/kerberos/advisories/)

## Related threats

- [MIT Kerberos 5 denial of service in ASN.1 SEQUENCE OF decoding](https://junglewise.ai/threats/cve-2026-119079-decode-sequence-of-in-lib-krb5-asn-1-asn1-encode-c-in-mit)
- [MIT Kerberos 5 kadmind memory exhaustion in AUTH_GSSAPI](https://junglewise.ai/threats/cve-2026-112323-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit)
- [MIT Kerberos 5 denial of service in kadmind AUTH_GSSAPI cleanup](https://junglewise.ai/threats/cve-2026-112322-clean-client-in-lib-rpc-svc-auth-gssapi-c-in-mit-kerberos-5-aka)
- [MIT Kerberos memory exhaustion in AUTH_GSSAPI handler](https://junglewise.ai/threats/cve-2026-112321-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit)
- [MIT Kerberos 5 memory exhaustion via GSS-RPC authentication context leak](https://junglewise.ai/threats/cve-2026-112320-the-gss-rpc-transport-layer-in-mit-kerberos-5-aka-krb5-1-4-and)