{"id":"CVE-2026-11850","aliases":["BELL-CVE-2026-11850","DEBIAN-CVE-2026-11850","EUVD-2026-36219","GHSA-85rq-mqr4-hjw7","RHSA-2026:25520","ROOT-OS-DEBIAN-12-CVE-2026-11850","ROOT-OS-DEBIAN-13-CVE-2026-11850","SUSE-SU-2026:22450-1","SUSE-SU-2026:22702-1","SUSE-SU-2026:2847-1","SUSE-SU-2026:2848-1","SUSE-SU-2026:2849-1","SUSE-SU-2026:2954-1","UBUNTU-CVE-2026-11850","USN-8585-1","openSUSE-SU-2026:11177-1","openSUSE-SU-2026:21238-1"],"status":"published","title":"Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00271,"percentile":0.19542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191"],"published":"2026-06-11T09:49:07Z","modified":"2026-11-06T07:39:13Z","fixes":[{"ecosystem":"Alpaquita:23","package":"krb5","fixed_in":["1.20.2-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"krb5","fixed_in":["1.21.3-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"krb5","fixed_in":["1.22.2-r3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"krb5","fixed_in":["1.22.1-3"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"krb5","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"krb5-devel","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"krb5-libs","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"krb5-pkinit","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"krb5-server","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"krb5-server-ldap","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"krb5-tests","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"krb5-workstation","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"krb5-xrealmauthz","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libkadm5","fixed_in":["0:1.22.2-8.hum1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"krb5","fixed_in":["1.20.1-2+deb12u5.aikido.10","1.20.1-2+deb12u5.aikido.12","1.20.1-2+deb12u5.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-krb5","fixed_in":["1.20.1-2+deb12u5.aikido.10","1.20.1-2+deb12u5.aikido.12","1.20.1-2+deb12u5.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"krb5","fixed_in":["1.21.3-5+deb13u1.aikido.3","1.21.3-5+deb13u1.root.io.2","1.21.3-5+deb13u1.aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-krb5","fixed_in":["1.21.3-5+deb13u1.aikido.3","1.21.3-5+deb13u1.root.io.2","1.21.3-5+deb13u1.aikido.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"krb5","fixed_in":["1.21.3-slfo.1.1_5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"krb5","fixed_in":["1.20.1-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"krb5","fixed_in":["1.20.1-150500.3.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"krb5","fixed_in":["1.20.1-150500.3.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"krb5","fixed_in":["1.20.1-150500.3.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"krb5","fixed_in":["1.20.1-150500.3.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"krb5","fixed_in":["1.20.1-150500.3.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"krb5","fixed_in":["1.16.3-46.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"krb5","fixed_in":["1.16.3-46.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"krb5","fixed_in":["1.19.2-150400.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"krb5","fixed_in":["1.19.2-150400.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"krb5","fixed_in":["1.19.2-150400.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"krb5","fixed_in":["1.19.2-150400.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"krb5","fixed_in":["1.19.2-150400.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"krb5","fixed_in":["1.19.2-150400.3.24.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"krb5","fixed_in":["1.19.2-2ubuntu0.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"krb5","fixed_in":["1.20.1-6ubuntu2.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"krb5","fixed_in":["1.22.1-2ubuntu4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"krb5","fixed_in":["1.22.2-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"krb5","fixed_in":["1.21.3-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r0"},{"fixed":"1.20.2-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.21.3-r0"},{"fixed":"1.21.3-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r2"},{"fixed":"1.22.2-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-2","1.20.1-2+deb12u1","1.20.1-2+deb12u2","1.20.1-2+deb12u3","1.20.1-2+deb12u4","1.20.1-2+deb12u5","1.20.1-2+loong64","1.20.1-3","1.20.1-4","1.20.1-5","1.20.1-5.1","1.20.1-5.1~exp1","1.20.1-6","1.21.2-1","1.21.3-1","1.21.3-2","1.21.3-3","1.21.3-4","1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.21.3-5+deb13u1","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-3"}]}],"versions":["1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-server-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-workstation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"krb5-xrealmauthz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libkadm5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-8.hum1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-2+deb12u5.aikido.10"},{"fixed":"1.20.1-2+deb12u5.aikido.12"},{"fixed":"1.20.1-2+deb12u5.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-2+deb12u5.aikido.10"},{"fixed":"1.20.1-2+deb12u5.aikido.12"},{"fixed":"1.20.1-2+deb12u5.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-5+deb13u1.aikido.3"},{"fixed":"1.21.3-5+deb13u1.root.io.2"},{"fixed":"1.21.3-5+deb13u1.aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-5+deb13u1.aikido.3"},{"fixed":"1.21.3-5+deb13u1.root.io.2"},{"fixed":"1.21.3-5+deb13u1.aikido.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-slfo.1.1_5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150500.3.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150500.3.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150500.3.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150500.3.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150500.3.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150600.11.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150600.11.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150600.11.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150600.11.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-46.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-46.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150400.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150400.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150400.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150400.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150400.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150400.3.24.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1+dfsg-6.1ubuntu1","1.11.3+dfsg-3ubuntu2","1.12+dfsg-2ubuntu1","1.12+dfsg-2ubuntu2","1.12+dfsg-2ubuntu3","1.12+dfsg-2ubuntu4","1.12+dfsg-2ubuntu4.2","1.12+dfsg-2ubuntu5","1.12+dfsg-2ubuntu5.1","1.12+dfsg-2ubuntu5.2","1.12+dfsg-2ubuntu5.3","1.12+dfsg-2ubuntu5.4","1.12+dfsg-2ubuntu5.4+esm1","1.12+dfsg-2ubuntu5.4+esm2","1.12+dfsg-2ubuntu5.4+esm3","1.12+dfsg-2ubuntu5.4+esm4","1.12+dfsg-2ubuntu5.4+esm5","1.12+dfsg-2ubuntu5.4+esm6","1.12+dfsg-2ubuntu5.4+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-2","1.13.2+dfsg-3","1.13.2+dfsg-4","1.13.2+dfsg-5","1.13.2+dfsg-5ubuntu1","1.13.2+dfsg-5ubuntu2","1.13.2+dfsg-5ubuntu2.1","1.13.2+dfsg-5ubuntu2.1+esm1","1.13.2+dfsg-5ubuntu2.2","1.13.2+dfsg-5ubuntu2.2+esm1","1.13.2+dfsg-5ubuntu2.2+esm2","1.13.2+dfsg-5ubuntu2.2+esm3","1.13.2+dfsg-5ubuntu2.2+esm4","1.13.2+dfsg-5ubuntu2.2+esm5","1.13.2+dfsg-5ubuntu2.2+esm6","1.13.2+dfsg-5ubuntu2.2+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-2","1.16-2","1.16-2build1","1.16-2ubuntu0.1","1.16-2ubuntu0.1+esm1","1.16-2ubuntu0.2","1.16-2ubuntu0.3","1.16-2ubuntu0.4","1.16-2ubuntu0.4+esm1","1.16-2ubuntu0.4+esm2","1.16-2ubuntu0.4+esm3","1.16-2ubuntu0.4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-6","1.17-6ubuntu3","1.17-6ubuntu4","1.17-6ubuntu4.1","1.17-6ubuntu4.2","1.17-6ubuntu4.3","1.17-6ubuntu4.4","1.17-6ubuntu4.6","1.17-6ubuntu4.7","1.17-6ubuntu4.8","1.17-6ubuntu4.9","1.17-6ubuntu4.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-2ubuntu0.8"}]}],"versions":["1.18.3-6","1.18.3-7","1.19.2-0ubuntu1","1.19.2-1","1.19.2-2","1.19.2-2ubuntu0.1","1.19.2-2ubuntu0.2","1.19.2-2ubuntu0.3","1.19.2-2ubuntu0.4","1.19.2-2ubuntu0.5","1.19.2-2ubuntu0.6","1.19.2-2ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-6ubuntu2.7"}]}],"versions":["1.20.1-3ubuntu1","1.20.1-5build1","1.20.1-6ubuntu1","1.20.1-6ubuntu2","1.20.1-6ubuntu2.1","1.20.1-6ubuntu2.2","1.20.1-6ubuntu2.3","1.20.1-6ubuntu2.4","1.20.1-6ubuntu2.5","1.20.1-6ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-4ubuntu2","1.21.3-5ubuntu1","1.21.3-5ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-2ubuntu4.1"}]}],"versions":["1.21.3-5ubuntu2","1.22.1-2","1.22.1-2ubuntu2","1.22.1-2ubuntu3","1.22.1-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-2ubuntu0.8"}]}],"versions":["1.18.3-6","1.18.3-7","1.19.2-0ubuntu1","1.19.2-1","1.19.2-2","1.19.2-2ubuntu0.1","1.19.2-2ubuntu0.2","1.19.2-2ubuntu0.3","1.19.2-2ubuntu0.4","1.19.2-2ubuntu0.5","1.19.2-2ubuntu0.6","1.19.2-2ubuntu0.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-6ubuntu2.7"}]}],"versions":["1.20.1-3ubuntu1","1.20.1-5build1","1.20.1-6ubuntu1","1.20.1-6ubuntu2","1.20.1-6ubuntu2.1","1.20.1-6ubuntu2.2","1.20.1-6ubuntu2.3","1.20.1-6ubuntu2.4","1.20.1-6ubuntu2.5","1.20.1-6ubuntu2.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-2ubuntu4.1"}]}],"versions":["1.21.3-5ubuntu2","1.22.1-2","1.22.1-2ubuntu2","1.22.1-2ubuntu3","1.22.1-2ubuntu4"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3-160000.4.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:25520","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11850","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459970","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11850","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-85rq-mqr4-hjw7"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-11850","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-11850","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25520.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11850","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622450-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268131","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11850","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622702-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262847-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262848-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263366","tags":["report"]},{"url":"https://bugzilla.suse.com/1263367","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40356","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262849-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262954-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-11850","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8585-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40356","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-11850","title":"Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.","status":"published","published":"2026-06-11T09:49:07.726Z","modified":"2026-11-07T05:01:54.673Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-191"],"updated_at":"2026-11-07T06:32:53.224764Z"}],"euvd":[{"id":"EUVD-2026-36219","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.","status":"published","published":"2026-06-11T09:49:07Z","modified":"2026-11-07T05:01:54Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T06:08:30.731226Z"}],"ghsa":[{"id":"GHSA-85rq-mqr4-hjw7","title":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in...","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.","status":"published","published":"2026-06-11T12:32:43Z","modified":"2026-06-12T15:30:31Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T15:08:45.184845Z"}],"nvd":[{"id":"CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.","status":"published","published":"2026-06-11T10:16:21.217Z","modified":"2026-11-06T08:17:19.393Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-191"],"updated_at":"2026-11-06T11:59:56.337908Z"}],"osv":[{"id":"BELL-CVE-2026-11850","status":"published","published":"2026-06-12T06:10:38.505313Z","modified":"2026-06-18T07:15:11.253571273Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.","status":"published","published":"2026-06-11T10:16:21.217Z","modified":"2026-11-07T09:47:34.547395575Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"RHSA-2026:25520","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-06-13T10:05:48Z","modified":"2026-10-06T10:30:47.163516558Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"UBUNTU-CVE-2026-11850","description":"An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.","status":"published","published":"2026-06-11T10:16:00Z","modified":"2026-07-22T20:45:27.811204159Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"openSUSE-SU-2026:11177-1","title":"krb5-1.22.2-4.1 on GA media","description":"These are all security issues fixed in the krb5-1.22.2-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-02T00:00:00Z","modified":"2026-07-03T11:00:05.456886506Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21238-1","title":"Security update for krb5","description":"This update for krb5 fixes the following issue\n\n- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).\n","status":"published","published":"2026-07-05T13:38:43Z","modified":"2026-07-09T18:24:10.709765699Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-11850","title":"CVE-2026-11850 in krb5 - Patched by Root","description":"Root has patched CVE-2026-11850 in the krb5 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-15T10:03:35Z","modified":"2026-10-15T11:15:05.182290631Z","updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-11850","title":"CVE-2026-11850 in krb5 - Patched by Root","description":"Root has patched CVE-2026-11850 in the krb5 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-15T11:14:47Z","modified":"2026-10-15T12:15:04.092944459Z","updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"SUSE-SU-2026:22450-1","title":"Security update for krb5","description":"This update for krb5 fixes the following issue\n\n- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).\n","status":"published","published":"2026-06-30T09:04:51Z","modified":"2026-07-04T18:24:19.121524482Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22702-1","title":"Security update for krb5","description":"This update for krb5 fixes the following issue\n\n- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).\n","status":"published","published":"2026-07-07T12:04:16Z","modified":"2026-07-23T18:24:14.60342597Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2847-1","title":"Security update for krb5","description":"This update for krb5 fixes the following issue\n\n- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).\n","status":"published","published":"2026-07-10T11:38:37Z","modified":"2026-07-11T09:15:06.317758719Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2848-1","title":"Security update for krb5, krb5-mini","description":"This update for krb5, krb5-mini fixes the following issues\n\n- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).\n- CVE-2026-40355: Denial of Service via NULL pointer dereference in NegoEx mechanism (bsc#1263366).\n- CVE-2026-40356: Denial of Service via integer underflow and out-of-bounds read (bsc#1263367).\n","status":"published","published":"2026-07-10T11:39:12Z","modified":"2026-07-11T09:15:06.224711276Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2849-1","title":"Security update for krb5","description":"This update for krb5 fixes the following issue\n\n- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).\n","status":"published","published":"2026-07-10T11:39:21Z","modified":"2026-07-11T09:15:06.226859381Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2954-1","title":"Security update for krb5","description":"This update for krb5 fixes the following issue\n\n- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).\n","status":"published","published":"2026-07-14T09:57:36Z","modified":"2026-07-15T10:00:14.506400714Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8585-1","title":"krb5 vulnerabilities","description":"It was discovered that Kerberos had an integer underflow vulnerability\nin the berval2tl_data() function. An attacker could possibly use this issue\nto cause Kerberos to crash, resulting in a denial of service.\n(CVE-2026-11850)\n\nIt was discovered that Kerberos had vulnerabilities in its NegoEx mechanism\nparsing. A remote attacker could possibly use these issues to cause\nKerberos to crash, resulting in a denial of service. (CVE-2026-40355,\nCVE-2026-40356)","status":"published","published":"2026-07-22T13:04:35Z","modified":"2026-07-22T20:59:37.292009472Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}