{"id":"CVE-2026-107708","aliases":["ALPINE-CVE-2026-107708","AZL-106836","BELL-CVE-2026-107708","CLSA-2026-1791811122","DEBIAN-CVE-2026-107708","EUVD-2026-95255","GHSA-wc3c-9xc9-26g8","OESA-2026-4491","OESA-2026-4492","OESA-2026-4493","RHSA-2026:80481","SUSE-SU-2026:4906-1","UBUNTU-CVE-2026-107708"],"status":"published","title":"MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00521,"percentile":0.44695,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-10-08T20:15:53Z","modified":"2026-11-12T07:15:03Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.21.3-5"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.21.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r2"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"krb5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-8.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"krb5-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-8.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-8.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"krb5-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-8.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"krb5-server-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-8.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"krb5-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-8.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"krb5-workstation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-8.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libkadm5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-8.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-2","1.20.1-2+deb12u1","1.20.1-2+deb12u2","1.20.1-2+deb12u3","1.20.1-2+deb12u4","1.20.1-2+deb12u5","1.20.1-2+loong64","1.20.1-3","1.20.1-4","1.20.1-5","1.20.1-5.1","1.20.1-5.1~exp1","1.20.1-6","1.21.2-1","1.21.3-1","1.21.3-2","1.21.3-3","1.21.3-4","1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.21.3-5+deb13u1","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-23.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-23.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-23.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-server-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-workstation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-xrealmauthz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libkadm5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-10.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150500.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1+dfsg-6.1ubuntu1","1.11.3+dfsg-3ubuntu2","1.12+dfsg-2ubuntu1","1.12+dfsg-2ubuntu2","1.12+dfsg-2ubuntu3","1.12+dfsg-2ubuntu4","1.12+dfsg-2ubuntu4.2","1.12+dfsg-2ubuntu5","1.12+dfsg-2ubuntu5.1","1.12+dfsg-2ubuntu5.2","1.12+dfsg-2ubuntu5.3","1.12+dfsg-2ubuntu5.4","1.12+dfsg-2ubuntu5.4+esm1","1.12+dfsg-2ubuntu5.4+esm2","1.12+dfsg-2ubuntu5.4+esm3","1.12+dfsg-2ubuntu5.4+esm4","1.12+dfsg-2ubuntu5.4+esm5","1.12+dfsg-2ubuntu5.4+esm6","1.12+dfsg-2ubuntu5.4+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-2","1.13.2+dfsg-3","1.13.2+dfsg-4","1.13.2+dfsg-5","1.13.2+dfsg-5ubuntu1","1.13.2+dfsg-5ubuntu2","1.13.2+dfsg-5ubuntu2.1","1.13.2+dfsg-5ubuntu2.1+esm1","1.13.2+dfsg-5ubuntu2.2","1.13.2+dfsg-5ubuntu2.2+esm1","1.13.2+dfsg-5ubuntu2.2+esm2","1.13.2+dfsg-5ubuntu2.2+esm3","1.13.2+dfsg-5ubuntu2.2+esm4","1.13.2+dfsg-5ubuntu2.2+esm5","1.13.2+dfsg-5ubuntu2.2+esm6","1.13.2+dfsg-5ubuntu2.2+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-2","1.16-2","1.16-2build1","1.16-2ubuntu0.1","1.16-2ubuntu0.1+esm1","1.16-2ubuntu0.2","1.16-2ubuntu0.3","1.16-2ubuntu0.4","1.16-2ubuntu0.4+esm1","1.16-2ubuntu0.4+esm2","1.16-2ubuntu0.4+esm3","1.16-2ubuntu0.4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-6","1.17-6ubuntu3","1.17-6ubuntu4","1.17-6ubuntu4.1","1.17-6ubuntu4.2","1.17-6ubuntu4.3","1.17-6ubuntu4.4","1.17-6ubuntu4.6","1.17-6ubuntu4.7","1.17-6ubuntu4.8","1.17-6ubuntu4.9","1.17-6ubuntu4.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.3-6","1.18.3-7","1.19.2-0ubuntu1","1.19.2-1","1.19.2-2","1.19.2-2ubuntu0.1","1.19.2-2ubuntu0.2","1.19.2-2ubuntu0.3","1.19.2-2ubuntu0.4","1.19.2-2ubuntu0.5","1.19.2-2ubuntu0.6","1.19.2-2ubuntu0.7","1.19.2-2ubuntu0.8","1.19.2-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-3ubuntu1","1.20.1-5build1","1.20.1-6ubuntu1","1.20.1-6ubuntu2","1.20.1-6ubuntu2.1","1.20.1-6ubuntu2.2","1.20.1-6ubuntu2.3","1.20.1-6ubuntu2.4","1.20.1-6ubuntu2.5","1.20.1-6ubuntu2.6","1.20.1-6ubuntu2.7","1.20.1-6ubuntu2.8","1.20.1-6ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-2ubuntu4","1.22.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5ubuntu2","1.22.1-2","1.22.1-2ubuntu2","1.22.1-2ubuntu3","1.22.1-2ubuntu4","1.22.1-2ubuntu4.1"]}],"products":[{"vendor":"mit","product":"krb5"}],"references":[{"url":"https://github.com/krb5/krb5/pull/1510","tags":["issue-tracking","patch","fix","article","report"]},{"url":"https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","tags":["patch","fix","article"]},{"url":"https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","tags":["patch","fix","article"]},{"url":"https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","tags":["technical-description","article"]},{"url":"https://github.com/krb5/krb5","tags":["product","package","article"]},{"url":"https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac","tags":["third-party-advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wc3c-9xc9-26g8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-107708","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-107708","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791811122.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107708.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-107708","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4491","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4492","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4493","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80481","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107778","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107708","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80481.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548262","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107708","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107778","tags":["advisory"]},{"url":"https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","tags":["article"]},{"url":"https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","tags":["article"]},{"url":"https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","tags":["article"]},{"url":"https://github.com/krb5/krb5/pull/1511","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264906-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1284816","tags":["report"]},{"url":"https://bugzilla.suse.com/1284817","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107778","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-107708","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-107708","title":"MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","status":"published","published":"2026-10-08T20:15:53.534Z","modified":"2026-10-14T01:18:51.696Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-95255","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","status":"published","published":"2026-10-08T20:15:53Z","modified":"2026-10-14T01:18:51Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:18.393051Z"}],"ghsa":[{"id":"GHSA-wc3c-9xc9-26g8","title":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's...","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","status":"published","published":"2026-10-08T21:33:29Z","modified":"2026-10-08T21:33:35Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:12:58.478725Z"}],"nvd":[{"id":"CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","status":"published","published":"2026-10-08T21:17:52.223Z","modified":"2026-10-14T02:16:57.58Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"ALPINE-CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","status":"published","published":"2026-10-08T21:17:52.223Z","modified":"2026-11-10T15:30:03.185203068Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-10T16:03:01.153645Z"},{"id":"BELL-CVE-2026-107708","status":"published","published":"2026-10-09T06:05:29.721207Z","modified":"2026-11-12T07:15:03.407343619Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-12T07:34:29.179757Z"},{"id":"CVE-2026-107708","title":"MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","status":"published","published":"2026-10-08T20:15:53.534Z","modified":"2026-10-28T10:46:01.219347771Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"DEBIAN-CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","status":"published","published":"2026-10-08T21:17:52.223Z","modified":"2026-10-14T10:00:29.164236497Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:49.381767Z"},{"id":"OESA-2026-4491","title":"krb5 security update","description":"Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.\r\n\r\nSecurity Fix(es):\n\nMIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC\u0026apos;s get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.(CVE-2026-107708)\n\nMIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.(CVE-2026-107778)","status":"published","published":"2026-10-22T14:35:46Z","modified":"2026-10-22T14:45:10.480470873Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4492","title":"krb5 security update","description":"Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.\r\n\r\nSecurity Fix(es):\n\nMIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC\u0026apos;s get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.(CVE-2026-107708)\n\nMIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.(CVE-2026-107778)","status":"published","published":"2026-10-22T14:35:47Z","modified":"2026-10-22T14:45:10.491246542Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4493","title":"krb5 security update","description":"Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.\r\n\r\nSecurity Fix(es):\n\nMIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC\u0026apos;s get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.(CVE-2026-107708)\n\nMIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.(CVE-2026-107778)","status":"published","published":"2026-10-22T14:35:47Z","modified":"2026-10-22T14:45:11.090446761Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:80481","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-14T10:31:40Z","modified":"2026-10-14T10:48:08.659773986Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","status":"published","published":"2026-10-08T21:17:00Z","modified":"2026-10-28T17:50:31Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"AZL-106836","title":"CVE-2026-107708 affecting package krb5 1.21.3-5","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","status":"published","published":"2026-10-08T21:17:52Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"CLSA-2026-1791811122","title":"krb5: Fix of 2 CVEs","description":"- CVE-2026-107778: avoid NULL pointer dereference in krb5_rd_cred() make_cred_list()\n- CVE-2026-107708: fix error handling in KDC PAC processing get_pac_princ_with_realm()","status":"published","published":"2026-10-12T13:18:53Z","modified":"2026-10-26T09:43:25.961873059Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"SUSE-SU-2026:4906-1","title":"Security update for krb5","description":"This update for krb5 fixes the following issues:\n\n- CVE-2026-107708: Denial of Service via malformed PAC in S4U2Proxy requests (bsc#1284816).\n- CVE-2026-107778: Denial of Service via crafted forwarded credentials (bsc#1284817).\n","status":"published","published":"2026-10-26T07:20:52Z","modified":"2026-10-26T20:15:05.605469378Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}