Critical Security Update for krb5 Packages: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:19145: Important: krb5 security update. Affects krb5-devel versions < 1.21.3-10.el10_2. Fixed in 1.21.3-10.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The krb5 package, part of the MIT Kerberos 5 authentication system, is designed to enhance network security by enabling secure authentication between clients and servers without transmitting passwords in plaintext. This system relies on a trusted third party, known as the Key Distribution Center (KDC), to facilitate secure communication. However, recent vulnerabilities have been identified that could lead to Denial of Service (DoS) attacks, compromising the integrity and availability of services relying on this authentication mechanism.
Vulnerability Detail
The vulnerabilities identified in the krb5 package include CVE-2026-40355 and CVE-2026-40356. CVE-2026-40355 involves a NULL pointer dereference in the NegoEx mechanism, which can lead to a Denial of Service condition. CVE-2026-40356 is related to an integer underflow and out-of-bounds read, also resulting in potential DoS. These vulnerabilities can be exploited by attackers to disrupt authentication services, leading to service outages and potential unauthorized access.
How To Fix
Minimum fixed version
1.21.3-10.el10_2
This is the first release that contains the fix.
sudo dnf update krb5-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you may consider disabling the NegoEx mechanism if it is not critical for your operations. However, this is not a long-term solution and should only be used until the packages can be updated.
Conclusion
In summary, the krb5 package has critical vulnerabilities that could lead to Denial of Service attacks. It is crucial to update to the patched version 1.21.3-10.el10_2 to secure your systems. Temporary workarounds are available, but they should not replace proper updates.
See every vulnerability recorded for krb5-devel →
FAQ
The main vulnerabilities are CVE-2026-40355, which involves a NULL pointer dereference, and CVE-2026-40356, which involves an integer underflow and out-of-bounds read, both leading to Denial of Service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using a manifest file like package-lock.json. You can check your application at Vulert Scanner without needing to sign up.
If immediate updates are not possible, consider disabling the NegoEx mechanism as a temporary workaround until you can apply the necessary updates.
Exploitation of these vulnerabilities can lead to Denial of Service, disrupting authentication services and potentially allowing unauthorized access to systems relying on krb5 for secure communication.
For more details, refer to the CVE pages for CVE-2026-40355 and CVE-2026-40356, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for krb5-devel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
