MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791811122 advisory.

  - MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's     get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed     names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC     carrying a malformed client name to crash krb5kdc and deny authentication. (CVE-2026-107708)

  - MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c     that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays.
    Attackers can send forwarded credentials with more tickets than ticket_info entries through     gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service. (CVE-2026-107778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791811122 advisory.

  - MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's     get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed     names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC     carrying a malformed client name to crash krb5kdc and deny authentication. (CVE-2026-107708)

  - MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c     that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays.
    Attackers can send forwarded credentials with more tickets than ticket_info entries through     gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service. (CVE-2026-107778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's
    get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed
    names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC
    carrying a malformed client name to crash krb5kdc and deny authentication. (CVE-2026-107708)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's     get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed     names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC     carrying a malformed client name to crash krb5kdc and deny authentication. (CVE-2026-107708)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364715	Rocky Linux 9.6 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791811122)	Nessus	Rocky Linux Local Security Checks	Local	high
364709	AlmaLinux 9.6 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791811122)	Nessus	Alma Linux Local Security Checks	Local	high
474347	Echo: krb5: security update to 1.21.3-5+e9	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474347	Echo: krb5: security update to 1.21.3-5+e9	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
364300	Linux Distros Unpatched Vulnerability : CVE-2026-107708	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-107708

medium

Tenable Plugins

high

high

medium

medium

medium