# CVE-2026-40356: MIT Kerberos 5 integer underflow in NegoEx message parsing

Source: https://junglewise.ai/threats/cve-2026-40356-mit-kerberos-5-integer-underflow-in-negoex-message-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-40356 · Severity: medium · CVSS 5.9 · Published 2026-04-28

MIT Kerberos 5 is a widely used authentication protocol integrated into major operating systems and Microsoft Active Directory. A vulnerability in its message parsing component allows an unauthenticated remote attacker to send a specially crafted network packet that causes the authentication service to crash. This results in a denial-of-service, potentially preventing users from logging into enterprise systems and accessing network resources.

Technologies: [Mit Kerberos 5](https://junglewise.ai/threats/technologies/kerberos-5). Vendors: [Mit](https://junglewise.ai/threats/vendors/mit).

## Quick answers

**Is CVE-2026-40356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40356 being exploited in the wild.

**How severe is CVE-2026-40356?** Medium severity, with a CVSS score of 5.9, published 28 April 2026.

**Which products and versions are affected?** Mit Kerberos 5 1.18.0 to 1.22.2.

**Is there a fix for CVE-2026-40356?** A patch was published on 2026-04-28: Fixed in upstream commit 2e75f0d Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40356 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40356?** Check whether you run Mit Kerberos 5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow vulnerability exists in the parse_message() function within src/lib/gssapi/spnego/negoex_util.c of MIT Kerberos 5. The flaw is triggered when a short header_len is provided in a NegoEx message, leading to an incorrect calculation of the remaining message length and a subsequent out-of-bounds read of up to 52 bytes. This can be exploited by an unauthenticated remote attacker if the target system has a NegoEx mechanism registered in /etc/gss/mech and calls gss_accept_sec_context(). While the out-of-bounds read can cause a process crash (denial-of-service), the vendor indicates that exfiltration of the read memory is unlikely. The issue is fixed in version 1.22.3.

## Affected products

- MIT Kerberos 5 1.18.0 to 1.22.2

## Timeline

- 2026-04-27: disclosed: Initial disclosure by researcher Cem Onat Karagun
- 2026-04-28: advisory: NVD and MITRE published advisory
- 2026-04-28: patched: Fixed in upstream commit 2e75f0d

## References

- [https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html](https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html)
- [https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f](https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f)
- [https://web.mit.edu/kerberos/advisories/](https://web.mit.edu/kerberos/advisories/)

## Related threats

- [MIT Kerberos 5 denial of service in ASN.1 SEQUENCE OF decoding](https://junglewise.ai/threats/cve-2026-119079-decode-sequence-of-in-lib-krb5-asn-1-asn1-encode-c-in-mit)
- [MIT Kerberos 5 kadmind memory exhaustion in AUTH_GSSAPI](https://junglewise.ai/threats/cve-2026-112323-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit)
- [MIT Kerberos 5 denial of service in kadmind AUTH_GSSAPI cleanup](https://junglewise.ai/threats/cve-2026-112322-clean-client-in-lib-rpc-svc-auth-gssapi-c-in-mit-kerberos-5-aka)
- [MIT Kerberos memory exhaustion in AUTH_GSSAPI handler](https://junglewise.ai/threats/cve-2026-112321-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit)
- [MIT Kerberos 5 memory exhaustion via GSS-RPC authentication context leak](https://junglewise.ai/threats/cve-2026-112320-the-gss-rpc-transport-layer-in-mit-kerberos-5-aka-krb5-1-4-and)