CVE-2026-40355: , CVE-2026-40356: MIT krb5 1.18+ Unauthenticated Network ad overrun and null pointer defence
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40355?
CVE-2026-40355 is classified as a critical severity vulnerability due to the potential for unauthenticated remote code execution.
How do I fix CVE-2026-40355?
To fix CVE-2026-40355, upgrade to MIT Kerberos 5 version 1.22.3 or later.
What are the consequences of CVE-2026-40355?
Exploitation of CVE-2026-40355 could lead to a denial of service or compromise of the affected system.
Who is affected by CVE-2026-40355?
CVE-2026-40355 affects all versions of MIT Kerberos 5 prior to 1.22.3 when NegoEx mechanism is registered.
What specific function is involved in CVE-2026-40355?
The vulnerability is triggered when the gss_accept_sec_context() function is called under specific conditions in the affected software.