# Mit vulnerabilities

Source: https://junglewise.ai/threats/vendors/mit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/mit.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 22 vulnerabilities in Mit: 11 in the last 7 days and 13 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119079, was published on 9 November 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before. 2 technologies have a page of their own.

## Counts

- Last 7 days: 11
- Last 30 days: 11
- Last 90 days: 13
- All time: 22 (1 critical, 0 exploited in the wild)

## About Mit

Massachusetts Institute of Technology, a private research university.

## Latest Mit vulnerabilities

- [CVE-2026-119079: MIT Kerberos 5 denial of service in ASN.1 SEQUENCE OF decoding](https://junglewise.ai/threats/cve-2026-119079-decode-sequence-of-in-lib-krb5-asn-1-asn1-encode-c-in-mit) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112323: MIT Kerberos 5 kadmind memory exhaustion in AUTH_GSSAPI](https://junglewise.ai/threats/cve-2026-112323-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112322: MIT Kerberos 5 denial of service in kadmind AUTH_GSSAPI cleanup](https://junglewise.ai/threats/cve-2026-112322-clean-client-in-lib-rpc-svc-auth-gssapi-c-in-mit-kerberos-5-aka) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112321: MIT Kerberos memory exhaustion in AUTH_GSSAPI handler](https://junglewise.ai/threats/cve-2026-112321-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112320: MIT Kerberos 5 memory exhaustion via GSS-RPC authentication context leak](https://junglewise.ai/threats/cve-2026-112320-the-gss-rpc-transport-layer-in-mit-kerberos-5-aka-krb5-1-4-and) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112319: MIT Kerberos 5 GSS-RPC unbounded memory allocation in kadmind](https://junglewise.ai/threats/cve-2026-112319-the-gss-rpc-layer-in-mit-kerberos-5-aka-krb5-does-not-enforce) (medium, CVSS 6.5, published 9 Nov 2026)
- [CVE-2026-112318: MIT Kerberos 5 kadmind null pointer dereference via policy RPC](https://junglewise.ai/threats/cve-2026-112318-the-policy-rpc-stubs-in-kadmin-server-server-stubs-c-in-mit) (medium, CVSS 6.5, published 9 Nov 2026)
- [CVE-2026-112317: MIT Kerberos 5 memory leak in krb5_ktkdb_get_entry()](https://junglewise.ai/threats/cve-2026-112317-krb5-ktkdb-get-entry-in-lib-kdb-keytab-c-in-mit-kerberos-5-aka) (medium, CVSS 5.3, published 9 Nov 2026)
- [CVE-2026-112316: MIT Kerberos 5 memory leak in xdr_krb5_tl_data()](https://junglewise.ai/threats/cve-2026-112316-xdr-krb5-tl-data-in-lib-kadm5-kadm-rpc-xdr-c-in-mit-kerberos-5) (medium, CVSS 6.5, published 9 Nov 2026)
- [CVE-2026-112315: MIT Kerberos 5 memory leak in RPCSEC_GSS authentication](https://junglewise.ai/threats/cve-2026-112315-the-rpcsec-gss-authentication-routines-in-lib-rpc-authgss-prot-c) (medium, CVSS 5.3, published 9 Nov 2026)
- [CVE-2026-112314: MIT Kerberos 5 memory leak in RPC client](https://junglewise.ai/threats/cve-2026-112314-clnttcp-call-in-lib-rpc-clnt-tcp-c-in-mit-kerberos-5-aka-krb5) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-107778: MIT Kerberos 5 NULL pointer dereference in rd_cred](https://junglewise.ai/threats/cve-2026-107778-mit-kerberos-5-krb5-through-1-22-2-contains-a-null-pointer) (medium, CVSS 6.5, published 8 Oct 2026)
- [CVE-2026-107708: MIT krb5 NULL pointer dereference in KDC get_pac_princ_with_realm](https://junglewise.ai/threats/cve-2026-107708-mit-krb5-through-1-22-2-contains-a-null-pointer-dereference) (medium, CVSS 4.9, published 8 Oct 2026)
- [CVE-2026-11850: MIT krb5 integer underflow in berval2tl_data function](https://junglewise.ai/threats/cve-2026-11850-mit-krb5-integer-underflow-in-berval2tl-data-function) (medium, CVSS 5, published 11 Jun 2026)
- [CVE-2026-40356: MIT Kerberos 5 integer underflow in NegoEx message parsing](https://junglewise.ai/threats/cve-2026-40356-mit-kerberos-5-integer-underflow-in-negoex-message-parsing) (medium, CVSS 5.9, published 28 Apr 2026)
- [CVE-2026-40355: MIT Kerberos 5 NULL pointer dereference in NegoEx parsing](https://junglewise.ai/threats/cve-2026-40355-mit-kerberos-5-null-pointer-dereference-in-negoex-parsing) (medium, CVSS 5.9, published 28 Apr 2026)
- [CVE-2025-3576: MIT Kerberos message spoofing via RC4-HMAC-MD5 MD5 collisions](https://junglewise.ai/threats/cve-2025-3576-mit-kerberos-message-spoofing-via-rc4-hmac-md5-md5-collisions) (medium, CVSS 5.9, published 15 Apr 2025)
- [CVE-2024-37371: MIT Kerberos 5 out-of-bounds read in GSS message token handling](https://junglewise.ai/threats/cve-2024-37371-mit-kerberos-5-out-of-bounds-read-in-gss-message-token-handling) (critical, CVSS 9.1, published 28 Jun 2024)
- [CVE-2024-37370: MIT Kerberos 5 message truncation in GSS krb5 wrap token](https://junglewise.ai/threats/cve-2024-37370-mit-kerberos-5-message-truncation-in-gss-krb5-wrap-token) (high, CVSS 7.5, published 28 Jun 2024)
- [CVE-1999-1296: MIT Kerberos buffer overflow in Kerberos IV compatibility library](https://junglewise.ai/threats/cve-1999-1296-mit-kerberos-buffer-overflow-in-kerberos-iv-compatibility-library) (high, CVSS 7.2, published 29 Apr 1997)
- [CVE-1999-1099: MIT Kerberos 4 Information Disclosure via Malformed UDP Packet](https://junglewise.ai/threats/cve-1999-1099-mit-kerberos-4-information-disclosure-via-malformed-udp-packet) (medium, CVSS 5, published 22 Nov 1996)
- [CVE-1999-0143: MIT Kerberos 4 session key forgery and masquerade](https://junglewise.ai/threats/cve-1999-0143-mit-kerberos-4-session-key-forgery-and-masquerade) (medium, CVSS 4.6, published 21 Feb 1996)

## Most severe Mit vulnerabilities

- [CVE-2024-37371: MIT Kerberos 5 out-of-bounds read in GSS message token handling](https://junglewise.ai/threats/cve-2024-37371-mit-kerberos-5-out-of-bounds-read-in-gss-message-token-handling) (critical, CVSS 9.1, published 28 Jun 2024)
- [CVE-2026-119079: MIT Kerberos 5 denial of service in ASN.1 SEQUENCE OF decoding](https://junglewise.ai/threats/cve-2026-119079-decode-sequence-of-in-lib-krb5-asn-1-asn1-encode-c-in-mit) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112323: MIT Kerberos 5 kadmind memory exhaustion in AUTH_GSSAPI](https://junglewise.ai/threats/cve-2026-112323-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112322: MIT Kerberos 5 denial of service in kadmind AUTH_GSSAPI cleanup](https://junglewise.ai/threats/cve-2026-112322-clean-client-in-lib-rpc-svc-auth-gssapi-c-in-mit-kerberos-5-aka) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112321: MIT Kerberos memory exhaustion in AUTH_GSSAPI handler](https://junglewise.ai/threats/cve-2026-112321-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112320: MIT Kerberos 5 memory exhaustion via GSS-RPC authentication context leak](https://junglewise.ai/threats/cve-2026-112320-the-gss-rpc-transport-layer-in-mit-kerberos-5-aka-krb5-1-4-and) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-112314: MIT Kerberos 5 memory leak in RPC client](https://junglewise.ai/threats/cve-2026-112314-clnttcp-call-in-lib-rpc-clnt-tcp-c-in-mit-kerberos-5-aka-krb5) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2024-37370: MIT Kerberos 5 message truncation in GSS krb5 wrap token](https://junglewise.ai/threats/cve-2024-37370-mit-kerberos-5-message-truncation-in-gss-krb5-wrap-token) (high, CVSS 7.5, published 28 Jun 2024)
- [CVE-1999-1296: MIT Kerberos buffer overflow in Kerberos IV compatibility library](https://junglewise.ai/threats/cve-1999-1296-mit-kerberos-buffer-overflow-in-kerberos-iv-compatibility-library) (high, CVSS 7.2, published 29 Apr 1997)
- [CVE-2026-107778: MIT Kerberos 5 NULL pointer dereference in rd_cred](https://junglewise.ai/threats/cve-2026-107778-mit-kerberos-5-krb5-through-1-22-2-contains-a-null-pointer) (medium, CVSS 6.5, published 8 Oct 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 2 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 2 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 11 | 0 | 0 |

## Mit technologies

- [Mit Kerberos 5](https://junglewise.ai/threats/technologies/kerberos-5): 17 vulnerabilities
- [Mit Krb5](https://junglewise.ai/threats/technologies/krb5): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mit vulnerabilities", https://junglewise.ai/threats/vendors/mit, 10 November 2026.