CVE-2024-26461: High severity MIT Kerberos 5 vulnerability
Published Feb 26, 2024
·Updated
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
Affected Software
17 affected componentsFixes available
debian/krb5<=1.18.3-6+deb11u5, <=1.18.3-6+deb11u6, <=1.20.1-2+deb12u2, <=1.21.3-4
MIT Kerberos 5=1.21.2
NetApp Active Iq Unified Manager Vmware Vsphere
NetApp Cloud Volumes Ontap Mediator
NetApp Management Services For Element Software And Netapp Hci
NetApp Ontap 9
NetApp ONTAP Select Deploy administration utility
All of the following
NetApp H610c Firmware
NetApp H610c
All of the following
NetApp H610s Firmware
NetApp H610s
All of the following
NetApp H615c Firmware
NetApp H615c
IBM Concert Software<=1.0.0-1.1.0
Microsoft cbl2 krb5 1.19.4-3
Microsoft azl3 krb5 1.21.2-1
Microsoft azl3 krb5 1.21.3-1
Event History
Feb 26, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Feb 28, 2024
Data Sourced
via Red Hat·09:14 PM
DescriptionSeverityAffected Software
Feb 29, 2024
Data Sourced
via NVD·01:44 AM
DescriptionSeverityWeakness
Aug 5, 2024
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Mar 3, 2025
Data Sourced
via Launchpad·06:27 PM
Description
Mar 7, 2025
Data Sourced
via Ubuntu·06:27 PM
RemedyDescriptionSeverityAffected Software
Aug 18, 2025
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-26461?
CVE-2024-26461 is classified as a medium severity vulnerability due to its potential impact on system performance through memory leaks.
2
How do I fix CVE-2024-26461?
To fix CVE-2024-26461, upgrade to a version of Kerberos 5 that is higher than 1.21.2.
3
What systems are affected by CVE-2024-26461?
CVE-2024-26461 affects IBM Storage Defender - Resiliency Service versions 2.0.0 to 2.0.9.
4
What causes the memory leak in CVE-2024-26461?
The memory leak in CVE-2024-26461 is caused by improper handling of memory in the k5sealv3.c file in Kerberos 5.
5
Is CVE-2024-26461 a remote vulnerability?
CVE-2024-26461 is not a remote vulnerability, but it can affect applications utilizing the vulnerable Kerberos library.