Critical Security Update for krb5 Packages: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:19357: Important: krb5 security update. Affects krb5-devel versions < 1.21.1-10.el9_8. Fixed in 1.21.1-10.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kerberos is a robust network authentication system designed to enhance security by preventing the transmission of passwords in unencrypted formats. It enables secure authentication between clients and servers through a trusted third party known as the Key Distribution Center (KDC). The krb5 packages, including krb5-devel, krb5-libs, and others, are essential components of the Kerberos authentication framework, providing libraries and tools necessary for implementing Kerberos in various applications.
Vulnerability Detail
The krb5 packages are affected by two critical vulnerabilities that can lead to Denial of Service (DoS) attacks. The first vulnerability (CVE-2026-40355) arises from a NULL pointer dereference in the NegoEx mechanism, which can cause the service to crash. The second vulnerability (CVE-2026-40356) is due to an integer underflow and out-of-bounds read, potentially allowing an attacker to exploit the system's memory. Both vulnerabilities can severely impact the availability of services relying on Kerberos authentication, making it crucial to address them promptly.
How To Fix
Minimum fixed version
1.21.1-10.el9_8
This is the first release that contains the fix.
sudo dnf update krb5-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to apply the security updates as soon as they are available.
Conclusion
The krb5 packages are critical for secure network authentication, and the identified vulnerabilities pose significant risks to system availability. It is essential to update to the patched version to protect against potential Denial of Service attacks. Regular monitoring and prompt updates are vital for maintaining security.
See every vulnerability recorded for krb5-devel →
FAQ
The main vulnerabilities are CVE-2026-40355, which involves a NULL pointer dereference, and CVE-2026-40356, which involves an integer underflow and out-of-bounds read.
These vulnerabilities can lead to Denial of Service attacks, causing the Kerberos authentication services to crash and become unavailable.
While there are no specific workarounds, it is recommended to monitor your systems closely and apply the updates as soon as possible to mitigate risks.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check your application in the Vulert playground without signup.
For more details, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for krb5-devel.
