{"id":"CVE-2022-41916","aliases":["ALPINE-CVE-2022-41916","AZL-11457","AZL-44835","BELL-CVE-2022-41916","DEBIAN-CVE-2022-41916","DLA-3206-1","DSA-5287-1","EUVD-2022-45046","GHSA-mgqr-gvh6-23cx","MGASA-2022-0468","UBUNTU-CVE-2022-41916","USN-5766-1","openSUSE-SU-2023:0019-1","openSUSE-SU-2023:0020-1","openSUSE-SU-2024:12580-1"],"status":"published","title":"Read one byte past a buffer when normalizing Unicode","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00995,"percentile":0.62904,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-193"],"published":"2022-11-15T00:00:00Z","modified":"2026-11-03T08:04:10Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"heimdal","fixed_in":["7.7.1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"samba","fixed_in":["4.18.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"heimdal","fixed_in":["7.8.git20221115.a6cf945+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"heimdal","fixed_in":["7.8.git20221115.a6cf945+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"heimdal","fixed_in":["7.8.git20221115.a6cf945+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"heimdal","fixed_in":["1.6~git20131207+dfsg-1ubuntu1.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"heimdal","fixed_in":["1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"heimdal","fixed_in":["7.5.0+dfsg-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"heimdal","fixed_in":["7.7.0+dfsg-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.git20221115.a6cf945+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.git20221115.a6cf945+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.git20221115.a6cf945+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-3+deb10u1"}]}],"versions":["7.5.0+dfsg-3"],"bundled":7},{"source":"osv","ecosystem":"Debian:11","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0+dfsg-2+deb11u2"}]}],"versions":["7.7.0+dfsg-2","7.7.0+dfsg-2+deb11u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-1.2.mga8"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6~git20131207+dfsg-1ubuntu1.2+esm2"}]}],"versions":["1.6~git20120403+dfsg1-3ubuntu0.1","1.6~git20120403+dfsg1-3ubuntu0.2","1.6~git20131207+dfsg-1ubuntu1","1.6~git20131207+dfsg-1ubuntu1.1","1.6~git20131207+dfsg-1ubuntu1.2","1.6~git20131207+dfsg-1ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm2"}]}],"versions":["1.6~rc2+dfsg-10ubuntu1","1.7~git20150920+dfsg-4ubuntu1","1.7~git20150920+dfsg-4ubuntu1.16.04.1","1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-1ubuntu0.2"}]}],"versions":["7.4.0.dfsg.1-2","7.5.0+dfsg-1","7.5.0+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0+dfsg-1ubuntu1.2"}]}],"versions":["7.5.0+dfsg-3build1","7.7.0+dfsg-1","7.7.0+dfsg-1ubuntu1","7.7.0+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.7.0+dfsg-2ubuntu2","7.7.0+dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8.git20221117.28daf24+dfsg-3ubuntu1","7.8.git20221117.28daf24+dfsg-3ubuntu2","7.8.git20221117.28daf24+dfsg-3ubuntu3","7.8.git20221117.28daf24+dfsg-3ubuntu4","7.8.git20221117.28daf24+dfsg-4ubuntu1","7.8.git20221117.28daf24+dfsg-5ubuntu2","7.8.git20221117.28daf24+dfsg-5ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8.git20221117.28daf24+dfsg-9ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8.git20221117.28daf24+dfsg-11ubuntu1","7.8.git20221117.28daf24+dfsg-12ubuntu1","7.8.git20240113.1b4565a+dfsg-1ubuntu1","7.8.git20240113.1b4565a+dfsg-1ubuntu2","7.8.git20240113.1b4565a+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8.git20221117.28daf24+dfsg-9ubuntu1","7.8.git20221117.28daf24+dfsg-10ubuntu1","7.8.git20221117.28daf24+dfsg-11ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6~git20131207+dfsg-1ubuntu1.2+esm2"}]}],"versions":["1.6~git20120403+dfsg1-3ubuntu0.1","1.6~git20120403+dfsg1-3ubuntu0.2","1.6~git20131207+dfsg-1ubuntu1","1.6~git20131207+dfsg-1ubuntu1.1","1.6~git20131207+dfsg-1ubuntu1.2","1.6~git20131207+dfsg-1ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm2"}]}],"versions":["1.6~rc2+dfsg-10ubuntu1","1.7~git20150920+dfsg-4ubuntu1","1.7~git20150920+dfsg-4ubuntu1.16.04.1","1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-1ubuntu0.2"}]}],"versions":["7.4.0.dfsg.1-2","7.5.0+dfsg-1","7.5.0+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0+dfsg-1ubuntu1.2"}]}],"versions":["7.5.0+dfsg-3build1","7.7.0+dfsg-1","7.7.0+dfsg-1ubuntu1","7.7.0+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"libheimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0-bp154.2.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libheimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0-bp154.2.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"libheimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0-bp153.2.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libheimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0-bp153.2.4.1"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"heimdal","product":"heimdal"},{"vendor":"heimdal_project","product":"heimdal"}],"references":[{"url":"https://github.com/heimdal/heimdal/security/advisories/GHSA-mgqr-gvh6-23cx","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2022/dsa-5287","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://security.netapp.com/advisory/ntap-20230216-0008/","tags":["x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202310-06","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-41916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41916","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-41916","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41916.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-41916","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0468.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31172","tags":["report"]},{"url":"https://www.debian.org/security/2022/dsa-5286","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3206","tags":["web"]},{"url":"https://github.com/heimdal/heimdal/security/advisories/GHSA-q77c-9qvp-qfw4","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/AYXWFESBZJMBNACFDHWWH7KETGKUXDPO/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-41916","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5766-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41916","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WO45C5LQHPOWEJHKWCXPWLI54XMTTYQP/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44640","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VCW7YX6RG5EAFBRU3SLTXKN5NWVODXTH/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-41916","title":"Read one byte past a buffer when normalizing Unicode","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2025-04-23T16:37:26.786Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:34:28.038197Z"}],"euvd":[{"id":"EUVD-2022-45046","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2025-04-23T16:37:26Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:12.313971Z"}],"nvd":[{"id":"CVE-2022-41916","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","status":"published","published":"2022-11-15T23:15:27.197Z","modified":"2026-06-17T05:04:03.423Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:07:32.395456Z"}],"osv":[{"id":"ALPINE-CVE-2022-41916","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","status":"published","published":"2022-11-15T23:15:27.197Z","modified":"2026-11-03T07:18:33.736589771Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-11457","title":"CVE-2022-41916 affecting package heimdal for versions less than 7.7.1-1","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","status":"published","published":"2022-11-15T23:15:27Z","modified":"2026-04-21T04:22:07.526552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"AZL-44835","title":"CVE-2022-41916 affecting package samba for versions less than 4.18.3-1","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","status":"published","published":"2022-11-15T23:15:27Z","modified":"2026-04-21T04:48:30.518944Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"BELL-CVE-2022-41916","title":"CVE-2022-41916 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:26.68651Z","modified":"2026-01-26T09:46:25.029428Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-41916","title":"Read one byte past a buffer when normalizing Unicode","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-28T10:30:52.462995942Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"DEBIAN-CVE-2022-41916","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","status":"published","published":"2022-11-15T23:15:27.197Z","modified":"2026-11-03T08:04:10.723761975Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"UBUNTU-CVE-2022-41916","description":"Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.","status":"published","published":"2022-11-15T23:15:00Z","modified":"2026-10-17T12:56:22.665823519Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"DLA-3206-1","title":"heimdal - security update","status":"published","published":"2022-11-26T00:00:00Z","modified":"2026-03-09T01:19:51.266692Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5287-1","title":"heimdal - security update","status":"published","published":"2022-11-22T00:00:00Z","modified":"2026-03-09T02:11:16.81337Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0468","title":"Updated heimdal packages fix security vulnerability","description":"Isaac Boukris reported that the Heimdal KDC before 7.7.1 does not apply\ndelegation_not_allowed (aka not-delegated) user attributes for S4U2Self.\nInstead the forwardable flag is set even if the impersonated client has\nthe not-delegated flag set. (CVE-2019-14870)\n\nJoseph Sutton discovered that the Heimdal KDC before 7.7.1 does not check\nfor missing sname in TGS-REQ (Ticket Granting Server Request)\nbefore dereferencing. An authenticated user could use this flaw to\ncrash the KDC. (CVE-2021-3671)\n\nIt was discovered that Heimdal is prone to a NULL dereference in acceptors\nwhen the initial SPNEGO token has no acceptable mechanisms, which may\nresult in denial of service for a server application that uses the Simple\nand Protected GSSAPI Negotiation Mechanism (SPNEGO). (CVE-2021-44758)\n\nEvgeny Legerov reported that the DES and Triple-DES decryption routines in\nthe Heimdal GSSAPI library before 7.7.1 were prone to buffer overflow on\nmalloc() allocated memory when presented with a maliciously small packet.\nIn addition, the Triple-DES and RC4 (arcfour) decryption routine were\nprone to non-constant time leaks, which could potentially yield to a leak\nof secret key material when using these ciphers. (CVE-2022-3437)\n\nIt was discovered that Heimdal's PKI certificate validation library before\n7.7.1 can under some circumstances perform an out-of-bounds memory access\nwhen normalizing Unicode, which may result in denial of service. (CVE-2022-41916)\n\nGreg Hudson discovered an integer multiplication overflow in the Privilege\nAttribute Certificate (PAC) parsing routine, which may result in denial of\nservice for Heimdal KDCs and possibly Heimdal servers (e.g., via GSS-API)\non 32-bit systems. (CVE-2022-42898)\n\nDouglas Bagnall and the Heimdal maintainers independently discovered that\nHeimdal's ASN.1 compiler before 7.7.1 generates code that allows specially\ncrafted DER encodings of CHOICEs to invoke the wrong free() function on the\ndecoded structure upon decode error, which may result in remote code\nexecution in the Heimdal KDC and possibly the Kerberos client, the X.509\nlibrary, and other components as well. (CVE-2022-44640)\n","status":"published","published":"2022-12-17T18:48:08Z","modified":"2026-04-16T04:43:39.031315614Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0019-1","title":"Security update for libheimdal","description":"This update for libheimdal fixes the following issues:\n\nUpdate to version 7.8.0\n\n- CVE-2022-42898 PAC parse integer overflows\n- CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour\n- CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array\n- CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors\n- CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ\n- CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec\n- CVE-2019-14870: Validate client attributes in protocol-transition\n","status":"published","published":"2023-01-16T08:42:44Z","modified":"2026-02-04T03:44:03.250796Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0020-1","title":"Security update for libheimdal","description":"This update for libheimdal fixes the following issues:\n\nUpdate to version 7.8.0\n\n- CVE-2022-42898 PAC parse integer overflows\n- CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour\n- CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array\n- CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors\n- CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ\n- CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec\n- CVE-2019-14870: Validate client attributes in protocol-transition\n","status":"published","published":"2023-01-16T08:42:52Z","modified":"2026-02-04T02:58:44.117973Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12580-1","title":"libasn1-8-7.8.0-1.1 on GA media","description":"These are all security issues fixed in the libasn1-8-7.8.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:39.768947Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-5766-1","title":"heimdal vulnerability","description":"It was discovered that Heimdal did not properly manage memory when\nnormalizing Unicode. An attacker could possibly use this issue to\ncause a denial of service.\n","status":"published","published":"2022-12-07T23:29:35Z","modified":"2026-06-29T13:50:43.813166867Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}