{"id":"CVE-2026-119079","aliases":["ALPINE-CVE-2026-119079","DEBIAN-CVE-2026-119079","EUVD-2026-120226","GHSA-r2wv-55xh-q3w6"],"status":"published","title":"Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-408"],"published":"2026-11-09T18:43:39Z","modified":"2026-11-10T09:30:02Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-2","1.20.1-2+deb12u1","1.20.1-2+deb12u2","1.20.1-2+deb12u3","1.20.1-2+deb12u4","1.20.1-2+deb12u5","1.20.1-2+loong64","1.20.1-3","1.20.1-4","1.20.1-5","1.20.1-5.1","1.20.1-5.1~exp1","1.20.1-6","1.21.2-1","1.21.3-1","1.21.3-2","1.21.3-3","1.21.3-4","1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.21.3-5+deb13u1","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-119079","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479231","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079"},{"url":"https://github.com/advisories/GHSA-r2wv-55xh-q3w6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-119079","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-119079","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-119079","title":"Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.","status":"published","published":"2026-11-09T18:43:39.044Z","modified":"2026-11-09T18:43:39.044Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-408"],"updated_at":"2026-11-09T19:34:28.960398Z"}],"euvd":[{"id":"EUVD-2026-120226","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.","status":"published","published":"2026-11-09T18:43:39Z","modified":"2026-11-09T18:43:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-09T23:18:34.32174Z"}],"ghsa":[{"id":"GHSA-r2wv-55xh-q3w6","title":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later...","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.","status":"published","published":"2026-11-09T21:31:46Z","modified":"2026-11-09T21:31:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-408"],"updated_at":"2026-11-09T21:50:03.505275Z"}],"nvd":[{"id":"CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.","status":"published","published":"2026-11-09T19:16:43.023Z","modified":"2026-11-09T19:16:43.16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-408"],"updated_at":"2026-11-09T22:15:55.257524Z"}],"osv":[{"id":"ALPINE-CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.","status":"published","published":"2026-11-09T19:16:43.023Z","modified":"2026-11-10T09:30:02.883787251Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T09:56:02.898004Z"},{"id":"DEBIAN-CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.","status":"published","published":"2026-11-09T19:16:43.023Z","modified":"2026-11-10T05:00:06.473095976Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T05:22:46.487299Z"}]}}