Bug 2548269 (CVE-2026-107778) - CVE-2026-107778 krb5: krb5: Denial of Service via crafted forwarded credentials
Summary: CVE-2026-107778 krb5: krb5: Denial of Service via crafted forwarded credentials
Keywords:
Status: NEW
Alias: CVE-2026-107778
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-08 20:32 UTC by OSIDB Bzimport
Modified: 2026-10-08 20:38 UTC (History)
28 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-08 20:32:25 UTC 
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Note You need to log in before you can comment on or make changes to this bug.