If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message. This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients.

redhat RHSA-2025:21819: RHSA-2025:21819: idm:DL1 security update (Important)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21820 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21818 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21821 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:21806 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:21140 advisory.

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)
      * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:21139 advisory.

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)
      * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a6dd878882 advisory.

    Automatic update for python-kdcproxy-1.1.0-1.fc44.

    ##### **Changelog**

    ```
    * Wed Nov 19 2025 Julien Rische <jrische@redhat.com> - 1.1.0-1
    - New upstream version (1.1.0)
    - Use DNS discovery for declared realms only (CVE-2025-59088)       Resolves: rhbz#2415861
    - Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089)       Resolves: rhbz#2415860
    - Stop using deprecated \       CFLAGS=${CFLAGS:-${RPM_OPT_FLAGS}} LDFLAGS=${LDFLAGS:-${RPM_LD_FLAGS}}\       /usr/bin/python3 setup.py  build --executable=/usr/bin/python3 -sP     /\       CFLAGS=${CFLAGS:-${RPM_OPT_FLAGS}} LDFLAGS=${LDFLAGS:-${RPM_LD_FLAGS}}\       /usr/bin/python3 setup.py  install -O1 --skip-build --root /builddir/build/BUILD/python-     kdcproxy-1.1.0-build/BUILDROOT --prefix /usr macros       rm -rfv /builddir/build/BUILD/python-kdcproxy-1.1.0-build/BUILDROOT/usr/bin/__pycache__

      Resolves: rhbz#2377837

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:21748 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0180 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-59088:
    If kdcproxy receives a request for a realm which does not have server addresses defined in its     configuration, by default, it will query SRV records in the DNS zone matching the requested realm name.
    This creates a server-side request forgery vulnerability, since an attacker could send a request for a     realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which     may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal     network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where     the use_dns setting is explicitly set to false are not affected.

    CVE-2025-59089:
    If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side     request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length     to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire     buffered stream into a new     buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and     CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is     not exactly equal to the length indicated in the response     header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message.
    This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12     seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue     overflow, denying service to legitimate clients.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:21448 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21140 advisory.

    - Use DNS discovery for declared realms only (CVE-2025-59088)       Resolves: RHEL-113657

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:21141 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:21139 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:21138 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21140 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:21142 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

    * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side     request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length     to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire     buffered stream into a new buffer on each recv() call, even when the transfer is incomplete, causing     excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long     as the received data length is not exactly equal to the length indicated in the response header, even when     individual chunks or the total buffer exceed the maximum length of a Kerberos message. This allows an     attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds),     exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow,     denying service to legitimate clients. (CVE-2025-59089)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
276472	RHEL 8 : idm:DL1 (RHSA-2025:21820)	Nessus	Red Hat Local Security Checks	high
276467	RHEL 8 : idm:DL1 (RHSA-2025:21818)	Nessus	Red Hat Local Security Checks	high
276465	RHEL 8 : idm:DL1 (RHSA-2025:21821)	Nessus	Red Hat Local Security Checks	high
276452	RHEL 9 : python-kdcproxy (RHSA-2025:21806)	Nessus	Red Hat Local Security Checks	high
275835	AlmaLinux 8 : idm:DL1 (ALSA-2025:21140)	Nessus	Alma Linux Local Security Checks	high
275811	AlmaLinux 9 : python-kdcproxy (ALSA-2025:21139)	Nessus	Alma Linux Local Security Checks	high
275794	Fedora 44 : python-kdcproxy (2025-a6dd878882)	Nessus	Fedora Local Security Checks	high
275768	RHEL 9 : python-kdcproxy (RHSA-2025:21748)	Nessus	Red Hat Local Security Checks	high
275570	Alibaba Cloud Linux 3 : 0180: idm:DL1 (ALINUX3-SA-2025:0180)	Nessus	Alibaba Cloud Linux Local Security Checks	high
275526	RHEL 9 : python-kdcproxy (RHSA-2025:21448)	Nessus	Red Hat Local Security Checks	high
275478	Oracle Linux 8 : idm:DL1 (ELSA-2025-21140)	Nessus	Oracle Linux Local Security Checks	high
275456	RHEL 10 : python-kdcproxy (RHSA-2025:21141)	Nessus	Red Hat Local Security Checks	high
275245	RHEL 9 : python-kdcproxy (RHSA-2025:21139)	Nessus	Red Hat Local Security Checks	high
275244	RHEL 9 : python-kdcproxy (RHSA-2025:21138)	Nessus	Red Hat Local Security Checks	high
275243	RHEL 8 : idm:DL1 (RHSA-2025:21140)	Nessus	Red Hat Local Security Checks	high
275242	RHEL 10 : python-kdcproxy (RHSA-2025:21142)	Nessus	Red Hat Local Security Checks	high
275232	Linux Distros Unpatched Vulnerability : CVE-2025-59089	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-59089

medium

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium