Critical Security Update for krb5 Packages: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:16799: Important: krb5 security update. Affects krb5-devel versions < 1.18.2-34.el8_10. Fixed in 1.18.2-34.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The krb5 package, part of the MIT Kerberos 5 authentication system, is essential for secure network authentication. It enhances security by preventing the transmission of passwords in unencrypted formats, allowing clients and servers to authenticate through a trusted third party known as the Kerberos Key Distribution Center (KDC). This package is widely used in various applications to ensure secure communications.
Vulnerability Detail
This vulnerability arises from two critical issues within the krb5 package. The first issue (CVE-2026-40355) involves a NULL pointer dereference in the NegoEx mechanism, which can lead to a Denial of Service (DoS) attack, causing the service to become unavailable. The second issue (CVE-2026-40356) is an integer underflow and out-of-bounds read, which can also result in a DoS condition. Both vulnerabilities can be exploited by an attacker to disrupt the normal functioning of services relying on Kerberos authentication.
How To Fix
Minimum fixed version
1.18.2-34.el8_10
This is the first release that contains the fix.
sudo dnf update krb5-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate patching is not possible, consider restricting access to the affected services or implementing network-level protections to mitigate potential exploitation of these vulnerabilities.
Conclusion
The krb5 package has critical vulnerabilities that can lead to Denial of Service attacks. It is essential to update to the patched version to ensure the security and availability of services relying on Kerberos authentication. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for krb5-devel →
FAQ
The krb5 package is part of the MIT Kerberos 5 authentication system, which provides secure authentication for network services.
Exploitation of these vulnerabilities can lead to Denial of Service attacks, making services unavailable to legitimate users.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not feasible, consider implementing network-level protections or restricting access to the affected services as a temporary workaround.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about the issues.
Related vulnerabilities
Recent vulnerabilities recorded for krb5-devel.
