CVE-2026-91926

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.

This vulnerability is rated as Low severity because exploitation requires the attacker to control or impersonate the NTLM server (or hold a man-in-the-middle position), and the resulting memory leak is bounded and gradual, requiring sustained repeated authentications to produce meaningful resource exhaustion. The vulnerability only affects the NTLM client (initiator) path; the server (acceptor) path is not affected. Red Hat Enterprise Linux 8 ships gssntlmssp and is affected. gssntlmssp was removed from RHEL 9 and later releases, so those products are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.