Bug 2569307

Summary: CVE-2026-107364 krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: krb5Assignee: Julien Rische <jrische>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: abokovoy, antorres, ftrivino, jrische, j, sbose, ssorce
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["fdbe3988-f398-4d2b-9262-f66543cc9ef2"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2569161    

Description Vladimir Vasilev 2026-11-10 08:34:33 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The KDC decodes requests using the libkrb5 ASN.1 DER decoder, but obtains pointers to subsets of the encoding (such as the KDC-REQ-BODY) via its own fetch_asn1_field().  This utility function does not consider the input length, assumes the tag identifier is a single byte, and supports indefinite length encoding.  The libkrb5 decoder accepts multi-byte tag identifiers and does not enforce minimality of tag identifier encoding.  A request packet crafted using a non-minimal tag identifier can pass through the libkrb5 decoder, but fool fetch_asn1_field() into indefinite length processing, which may send it reading beyond the bounds of the packet.