Executive brief
gss-ntlmssp is a library used for NTLM authentication in enterprise environments. A memory leak in its NTLM message parser allows a malicious or man-in-the-middle server to trigger gradual memory exhaustion on the client during authentication, potentially causing the client to slow down or become unavailable after repeated auth attempts.
Technical details
The vulnerability is a memory leak (CWE-401) in the NTLM target-info parser component of gss-ntlmssp. When a crafted NTLM CHALLENGE message contains duplicate string-valued AV_PAIR entries, the parser allocates memory for each string value but fails to free the previous allocation when the same AV_PAIR type appears multiple times, leaking the earlier memory. The attack requires the attacker to control or be a man-in-the-middle to the NTLM server and the client to repeatedly authenticate. The vulnerability affects only the NTLM client (initiator) path; the server (acceptor) path is unaffected. Exploitation causes slow, bounded memory exhaustion leading to denial of service.
Affected products
- Red Hat gss-ntlmssp
Timeline
- 2026-09-15: disclosed