CVE-2026-109140

Description

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.

References

https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-115255

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS