Description
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Published: 2026-10-08
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via null‑pointer dereference
Action: Assess Impact
AI Analysis

Impact

The vulnerability is a NULL pointer dereference in the make_cred_list() function of rd_cred.c. It is triggered when an authenticated Kerberos client sends a KRB-CRED array that contains more tickets than the number of ticket_info entries; this mismatch causes an immediate crash of the GSS‑API acceptor process. The crash results in service denial for the affected Kerberos services but does not provide code execution or data exfiltration.

Affected Systems

All installations of MIT Kerberos 5 (krb5) up to and including version 1.22.2 are affected. The affected product is identified as MIT:krb5 and includes any systems running this library, such as Kerberos servers and GSS‑API acceptor services that rely on it.

Risk and Exploitability

The CVSS base score is 7.1, indicating a moderate severity. The EPSS score is not available, so the current probability of exploitation is uncertain. The CVE is not listed in the CISA KEV catalog. Attacking requires an authenticated client context to send a specifically crafted KRB‑CRED array, so remote attackers must obtain or forge valid Kerberos tickets. Once the malformed credentials are processed by gss_accept_sec_context, the target service crashes, causing a denial of service.

Generated by OpenCVE AI on October 8, 2026 at 21:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Kerberos 5 library to 1.22.3 or later, where the issue is fixed.
  • If an upgrade is not immediately possible, restrict GSS‑API accept calls to trusted hosts or networks to limit exposure.
  • Deploy monitoring or logging on Kerberos services to detect unexpected crashes and trigger an automated restart or alert to administrators.

Generated by OpenCVE AI on October 8, 2026 at 21:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 08 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Title MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
First Time appeared Mit
Mit kerberos 5
Weaknesses CWE-476
CPEs cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*
Vendors & Products Mit
Mit kerberos 5
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mit Kerberos 5
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-09T11:50:03.488Z

Reserved: 2026-10-08T20:02:23.913Z

Link: CVE-2026-107778

cve-icon Vulnrichment

Updated: 2026-10-09T11:49:56.796Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-08T21:17:52.630

Modified: 2026-10-09T12:17:09.410

Link: CVE-2026-107778

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-08T20:15:54Z

Links: CVE-2026-107778 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T22:30:18Z

Weaknesses