CVE-2026-40356

A flaw was found in MIT Kerberos 5 (krb5). An unauthenticated remote attacker can exploit an integer underflow and an out-of-bounds read vulnerability by calling gss_accept_sec_context() on a system with a NegoEx mechanism registered. This can lead to the process terminating, resulting in a Denial of Service (DoS).

This Moderate impact denial of service flaw in MIT Kerberos 5 (krb5) allows an unauthenticated remote attacker to trigger an integer underflow and out-of-bounds read. This vulnerability, which can lead to process termination, specifically affects systems where the NegoEx mechanism is registered and gss_accept_sec_context() is called. While Kerberos is a fundamental service, the prerequisite of a registered NegoEx mechanism limits the attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that the NegoEx mechanism is not registered in the /etc/gss/mech configuration file. Removing the corresponding entry from this file will prevent the vulnerable code path from being activated. This action may impact services that rely on the NegoEx GSS-API mechanism. A restart of affected Kerberos-dependent services may be required for the change to take effect.