Every CVE Search/ Get API key

CVE-2026-107708

MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

6.9 Medium

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.52%Unchanged since Oct 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Record
CVE-2026-107708
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2026-95255 6.9

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Record
EUVD-2026-95255
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wc3c-9xc9-26g8 6.9

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's...

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Record
GHSA-wc3c-9xc9-26g8
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 6.9

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Record
CVE-2026-107708
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVBELL-CVE-2026-107708 4.9
Record
BELL-CVE-2026-107708
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.9

MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Record
CVE-2026-107708
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-476
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2026-107708 6.9

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Record
DEBIAN-CVE-2026-107708
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-4491 6.9

krb5 security update

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.

Security Fix(es):

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.(CVE-2026-107708)

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.(CVE-2026-107778)

Record
OESA-2026-4491
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-4492 6.9

krb5 security update

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.

Security Fix(es):

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.(CVE-2026-107708)

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.(CVE-2026-107778)

Record
OESA-2026-4492
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-4493 6.9

krb5 security update

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.

Security Fix(es):

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.(CVE-2026-107708)

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.(CVE-2026-107778)

Record
OESA-2026-4493
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:80481 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:80481
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-107708 6.9

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Record
UBUNTU-CVE-2026-107708
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-106836 No score

CVE-2026-107708 affecting package krb5 1.21.3-5

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

Record
AZL-106836
Updated
2026-11-02
OSVCLSA-2026-1791811122 No score

krb5: Fix of 2 CVEs

  • CVE-2026-107778: avoid NULL pointer dereference in krb5_rd_cred() make_cred_list()
  • CVE-2026-107708: fix error handling in KDC PAC processing get_pac_princ_with_realm()
Record
CLSA-2026-1791811122
Updated
2026-11-02
OSVSUSE-SU-2026:4906-1 No score

Security update for krb5

This update for krb5 fixes the following issues:

  • CVE-2026-107708: Denial of Service via malformed PAC in S4U2Proxy requests (bsc#1284816).
  • CVE-2026-107778: Denial of Service via crafted forwarded credentials (bsc#1284817).
Record
SUSE-SU-2026:4906-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
krb5
Azure Linux:3
 through 1.21.3-5 None known
krb5
Alpaquita:23
 1.20.1-r0 and later None known
krb5
Alpaquita:25
 1.21.3-r0 and later None known
krb5
Alpaquita:stream
 1.20.1-r2 and later None known
krb5-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.21.1-8.el9_6.tuxcare.els2
1.21.1-8.el9_6.tuxcare.els2
krb5-libs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.21.1-8.el9_6.tuxcare.els2
1.21.1-8.el9_6.tuxcare.els2
krb5-pkinit
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.21.1-8.el9_6.tuxcare.els2
1.21.1-8.el9_6.tuxcare.els2
krb5-server
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.21.1-8.el9_6.tuxcare.els2
1.21.1-8.el9_6.tuxcare.els2
krb5-server-ldap
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.21.1-8.el9_6.tuxcare.els2
1.21.1-8.el9_6.tuxcare.els2
krb5-tests
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.21.1-8.el9_6.tuxcare.els2
1.21.1-8.el9_6.tuxcare.els2
Show 27 moreShow less
Affected packages
PackageAffectedFixed
krb5-workstation
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.21.1-8.el9_6.tuxcare.els2
1.21.1-8.el9_6.tuxcare.els2
libkadm5
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1.21.1-8.el9_6.tuxcare.els2
1.21.1-8.el9_6.tuxcare.els2
krb5
Debian:12
 All versions, plus listed versions
1.20.1-21.20.1-2+deb12u11.20.1-2+deb12u21.20.1-2+deb12u31.20.1-2+deb12u4
Show 18 moreShow less
1.20.1-2+deb12u51.20.1-2+loong641.20.1-31.20.1-41.20.1-51.20.1-5.11.20.1-5.1~exp11.20.1-61.21.2-11.21.3-11.21.3-21.21.3-31.21.3-41.21.3-51.22.1-11.22.1-21.22.1-2.11.22.1-3
 None known
krb5
Debian:13
 All versions, plus listed versions
1.21.3-51.21.3-5+deb13u11.22.1-11.22.1-21.22.1-2.11.22.1-3
 None known
krb5
Debian:14
 All versions, plus listed versions
1.21.3-51.22.1-11.22.1-21.22.1-2.11.22.1-3
 None known
krb5
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.21.2-23.oe2403sp1
1.21.2-23.oe2403sp1
krb5
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.21.2-23.oe2403sp3
1.21.2-23.oe2403sp3
krb5
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.21.2-23.oe2403sp4
1.21.2-23.oe2403sp4
krb5
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
krb5-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
krb5-libs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
krb5-pkinit
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
krb5-server
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
krb5-server-ldap
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
krb5-tests
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
krb5-workstation
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
krb5-xrealmauthz
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
libkadm5
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.22.2-10.3.hum1
0:1.22.2-10.3.hum1
krb5
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 1.20.1-150500.3.26.1
1.20.1-150500.3.26.1
krb5
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.10.1+dfsg-6.1ubuntu11.11.3+dfsg-3ubuntu21.12+dfsg-2ubuntu11.12+dfsg-2ubuntu21.12+dfsg-2ubuntu3
Show 14 moreShow less
1.12+dfsg-2ubuntu41.12+dfsg-2ubuntu4.21.12+dfsg-2ubuntu51.12+dfsg-2ubuntu5.11.12+dfsg-2ubuntu5.21.12+dfsg-2ubuntu5.31.12+dfsg-2ubuntu5.41.12+dfsg-2ubuntu5.4+esm11.12+dfsg-2ubuntu5.4+esm21.12+dfsg-2ubuntu5.4+esm31.12+dfsg-2ubuntu5.4+esm41.12+dfsg-2ubuntu5.4+esm51.12+dfsg-2ubuntu5.4+esm61.12+dfsg-2ubuntu5.4+esm7
 None known
krb5
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.13.2+dfsg-21.13.2+dfsg-31.13.2+dfsg-41.13.2+dfsg-51.13.2+dfsg-5ubuntu1
Show 11 moreShow less
1.13.2+dfsg-5ubuntu21.13.2+dfsg-5ubuntu2.11.13.2+dfsg-5ubuntu2.1+esm11.13.2+dfsg-5ubuntu2.21.13.2+dfsg-5ubuntu2.2+esm11.13.2+dfsg-5ubuntu2.2+esm21.13.2+dfsg-5ubuntu2.2+esm31.13.2+dfsg-5ubuntu2.2+esm41.13.2+dfsg-5ubuntu2.2+esm51.13.2+dfsg-5ubuntu2.2+esm61.13.2+dfsg-5ubuntu2.2+esm7
 None known
krb5
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.15.1-21.16-21.16-2build11.16-2ubuntu0.11.16-2ubuntu0.1+esm1
Show 7 moreShow less
1.16-2ubuntu0.21.16-2ubuntu0.31.16-2ubuntu0.41.16-2ubuntu0.4+esm11.16-2ubuntu0.4+esm21.16-2ubuntu0.4+esm31.16-2ubuntu0.4+esm5
 None known
krb5
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.17-61.17-6ubuntu31.17-6ubuntu41.17-6ubuntu4.11.17-6ubuntu4.2
Show 7 moreShow less
1.17-6ubuntu4.31.17-6ubuntu4.41.17-6ubuntu4.61.17-6ubuntu4.71.17-6ubuntu4.81.17-6ubuntu4.91.17-6ubuntu4.11
 None known
krb5
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.18.3-61.18.3-71.19.2-0ubuntu11.19.2-11.19.2-2
Show 9 moreShow less
1.19.2-2ubuntu0.11.19.2-2ubuntu0.21.19.2-2ubuntu0.31.19.2-2ubuntu0.41.19.2-2ubuntu0.51.19.2-2ubuntu0.61.19.2-2ubuntu0.71.19.2-2ubuntu0.81.19.2-2ubuntu0.10
 None known
krb5
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.20.1-3ubuntu11.20.1-5build11.20.1-6ubuntu11.20.1-6ubuntu21.20.1-6ubuntu2.1
Show 8 moreShow less
1.20.1-6ubuntu2.21.20.1-6ubuntu2.31.20.1-6ubuntu2.41.20.1-6ubuntu2.51.20.1-6ubuntu2.61.20.1-6ubuntu2.71.20.1-6ubuntu2.81.20.1-6ubuntu2.10
 None known
krb5
Ubuntu:26.10
 All versions, plus listed versions
1.22.1-2ubuntu41.22.1-3ubuntu2
 None known
krb5
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.21.3-5ubuntu21.22.1-21.22.1-2ubuntu21.22.1-2ubuntu31.22.1-2ubuntu41.22.1-2ubuntu4.1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-107708 is a medium vulnerability (CVSS 6.9) in Mit Krb5, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. No source names a fixed version.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open