CVE-2026-40355: , CVE-2026-40356: MIT krb5 1.18+ Unauthenticated Network ad overrun and null pointer defence
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parsenegomessage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/krb5to a version that resolves this vulnerability.Fixed in 1.18.3-6+deb11u8Fixed in 1.20.1-2+deb12u5Fixed in 1.21.3-5+deb13u1Fixed in 1.22.1-3 - Upgrade
Upgrade
MIT krb5 (Kerberos 5)to a version that resolves this vulnerability.Fixed in 1.22.3 - Upgrade
Upgrade
MIT krb5 (Kerberos 5)to a version that resolves this vulnerability.Fixed in 1.18
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40355?
CVE-2026-40355 is classified as a critical severity vulnerability due to the potential for unauthenticated remote code execution.
How do I fix CVE-2026-40355?
To fix CVE-2026-40355, upgrade to MIT Kerberos 5 version 1.22.3 or later.
What are the consequences of CVE-2026-40355?
Exploitation of CVE-2026-40355 could lead to a denial of service or compromise of the affected system.
Who is affected by CVE-2026-40355?
CVE-2026-40355 affects all versions of MIT Kerberos 5 prior to 1.22.3 when NegoEx mechanism is registered.
What specific function is involved in CVE-2026-40355?
The vulnerability is triggered when the gss_accept_sec_context() function is called under specific conditions in the affected software.