The vulnerability in Python‑kdcproxy permits a remote denial‑of‑service attack by exploiting its failure to bound the size of TCP upstream responses. When an attacker forces kdcproxy to connect to a server under their control, each recv() call copies the entire streamed data into a fresh buffer, even if the transfer is incomplete. Because no length limits are enforced, the component will allocate memory unboundedly and use excessive CPU, triggering exhaustion of server resources. kdcproxy also accepts incoming data chunks as long as their declared length does not exactly match the response header, allowing an attacker to send arbitrarily large data until the 12‑second timeout, further depleting CPU and memory. This classic uncontrolled memory allocation flaw in a security‑critical component is identified as CWE‑770.

The flaw impacts Red Hat Enterprise Linux 10, RHEL 7 ELS, RHEL 8, and RHEL 9 across all standard, extended update, and advanced mission‑critical update streams, as well as the latchset:kdcproxy component. The recent errata (RHSA‑2025:21138 through RHSA‑2025:21821) replace kdcproxy with a fixed package that enforces TCP response size limits and rejects oversized chunks. Any system running a kdcproxy version prior to these updates is susceptible.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of <1% suggests an extremely low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The most realistic attack path requires an attacker to cause kdcproxy to connect to an attacker‑controlled KDC, which could be achieved via server‑side request forgery or mis‑configured trusted host lists. Even though the exploitation probability is low, the impact can bring all Kerberos clients on the affected system to a halt if the denial‑of‑service succeeds.