There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read
    if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in
    /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to
    terminate in parse_message. (CVE-2026-40356)

  - In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls
    gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An
    unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
    (CVE-2026-40355)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99624 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    Security Fix(es):

    * krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests     (CVE-2026-112323)

    * krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322)

    * krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)

    * krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request     (CVE-2026-71200)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths     (CVE-2026-112321)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching     (CVE-2026-112320)

    * krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

    * krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation     (CVE-2026-112319)

    * krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers     (CVE-2026-112318)

    * krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path     (CVE-2026-112317)

    * krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)

    * krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure     (CVE-2026-112316)

    * krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure     (CVE-2026-112315)

    * krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)

    * krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)

    * krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)

    * krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)

    * krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

    Bug Fix(es) and Enhancement(s):

    * Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-10.3.z] (JIRA:RHEL-278063)

    * auth_gssapi_wrap_data xdr_bytes failure leak [rhel-10.3.z] (JIRA:RHEL-296012)

    * xdr_bytes() does not free its allocation on partial decode failure [rhel-10.3.z] (JIRA:RHEL-296023)

    * RPCSEC_GSS context lifecycle leaks [rhel-10.3.z] (JIRA:RHEL-296034)

    * xdr_krb5_principal decode leak [rhel-10.3.z] (JIRA:RHEL-296045)

    * process_chpw_request leak [rhel-10.3.z] (JIRA:RHEL-296056)

    * Read overruns in GSSRPC svcauth_unix [rhel-10.3.z] (JIRA:RHEL-296067)

    * Null dereference in KDC dispatch corner case [rhel-10.3.z] (JIRA:RHEL-296081)

    * KDC DoS based on otherName value in PKINIT SAN code [rhel-10.3.z] (JIRA:RHEL-296095)

    * Memory leak on krb5 gss_accept_sec_context() failure [rhel-10.3.z] (JIRA:RHEL-296112)

    * KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers     [rhel-10.3.z] (JIRA:RHEL-296127)

    * Dereference of empty first credential list element in GSS mechanism [rhel-10.3.z] (JIRA:RHEL-296997)

    * Null dereference of principal names in krb5_rd_cred() [rhel-10.3.z] (JIRA:RHEL-297000)

    * Fix validation issues for trusted inputs [rhel-10.3.z] (JIRA:RHEL-299144)

    * Skip expired keys when iterating over KEYRING ccache [rhel-10.3.z] (JIRA:RHEL-299145)

    * Pass through null deleg_cred from SPNEGO to mech [rhel-10.3.z] (JIRA:RHEL-299146)

    * Fix leaks on error in PKINIT signed-data creation [rhel-10.3.z] (JIRA:RHEL-299147)

    * Fix hex key input handling in ktutil addent [rhel-10.3.z] (JIRA:RHEL-299148)

    * Check reply length before V4 reply check [rhel-10.3.z] (JIRA:RHEL-299149)

    * Fix memory leak in mpool_get() error paths [rhel-10.3.z] (JIRA:RHEL-299150)

    * json: Correctly abort parse on invalid array [rhel-10.3.z] (JIRA:RHEL-299151)

    * Prevent unsigned int overflow in iakerb_save_token() [rhel-10.3.z] (JIRA:RHEL-299152)

    * Fix ksu memory leak in fcmd_resolve() [rhel-10.3.z] (JIRA:RHEL-299153)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99625 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    Security Fix(es):

    * krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests     (CVE-2026-112323)

    * krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322)

    * krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)

    * krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request     (CVE-2026-71200)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths     (CVE-2026-112321)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching     (CVE-2026-112320)

    * krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

    * krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation     (CVE-2026-112319)

    * krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers     (CVE-2026-112318)

    * krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path     (CVE-2026-112317)

    * krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)

    * krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure     (CVE-2026-112316)

    * krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure     (CVE-2026-112315)

    * krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)

    * krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)

    * krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)

    * krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)

    * krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

    Bug Fix(es) and Enhancement(s):

    * Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-10.2.z] (JIRA:RHEL-278062)

    * auth_gssapi_wrap_data xdr_bytes failure leak [rhel-10.2.z] (JIRA:RHEL-296011)

    * xdr_bytes() does not free its allocation on partial decode failure [rhel-10.2.z] (JIRA:RHEL-296022)

    * RPCSEC_GSS context lifecycle leaks [rhel-10.2.z] (JIRA:RHEL-296033)

    * xdr_krb5_principal decode leak [rhel-10.2.z] (JIRA:RHEL-296044)

    * process_chpw_request leak [rhel-10.2.z] (JIRA:RHEL-296055)

    * Read overruns in GSSRPC svcauth_unix [rhel-10.2.z] (JIRA:RHEL-296066)

    * Null dereference in KDC dispatch corner case [rhel-10.2.z] (JIRA:RHEL-296079)

    * KDC DoS based on otherName value in PKINIT SAN code [rhel-10.2.z] (JIRA:RHEL-296093)

    * Memory leak on krb5 gss_accept_sec_context() failure [rhel-10.2.z] (JIRA:RHEL-296111)

    * KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers     [rhel-10.2.z] (JIRA:RHEL-296126)

    * Dereference of empty first credential list element in GSS mechanism [rhel-10.2.z] (JIRA:RHEL-296996)

    * Null dereference of principal names in krb5_rd_cred() [rhel-10.2.z] (JIRA:RHEL-296999)

    * Fix validation issues for trusted inputs [rhel-10.2.z] (JIRA:RHEL-299156)

    * Skip expired keys when iterating over KEYRING ccache [rhel-10.2.z] (JIRA:RHEL-299157)

    * Fix ksu memory leak in fcmd_resolve() [rhel-10.2.z] (JIRA:RHEL-299158)

    * Prevent unsigned int overflow in iakerb_save_token() [rhel-10.2.z] (JIRA:RHEL-299159)

    * json: Correctly abort parse on invalid array [rhel-10.2.z] (JIRA:RHEL-299160)

    * Fix memory leak in mpool_get() error paths [rhel-10.2.z] (JIRA:RHEL-299161)

    * Check reply length before V4 reply check [rhel-10.2.z] (JIRA:RHEL-299162)

    * Fix hex key input handling in ktutil addent [rhel-10.2.z] (JIRA:RHEL-299163)

    * Fix leaks on error in PKINIT signed-data creation [rhel-10.2.z] (JIRA:RHEL-299164)

    * Pass through null deleg_cred from SPNEGO to mech [rhel-10.2.z] (JIRA:RHEL-299165)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99715 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    Security Fix(es):

    * krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests     (CVE-2026-112323)

    * krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322)

    * krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)

    * krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request     (CVE-2026-71200)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths     (CVE-2026-112321)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching     (CVE-2026-112320)

    * krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

    * krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation     (CVE-2026-112319)

    * krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers     (CVE-2026-112318)

    * krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path     (CVE-2026-112317)

    * krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)

    * krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure     (CVE-2026-112316)

    * krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure     (CVE-2026-112315)

    * krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)

    * krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)

    * krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)

    * krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)

    * krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

    Bug Fix(es) and Enhancement(s):

    * Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-9.9.z] (JIRA:RHEL-278059)

    * auth_gssapi_wrap_data xdr_bytes failure leak [rhel-9.9.z] (JIRA:RHEL-296018)

    * xdr_bytes() does not free its allocation on partial decode failure [rhel-9.9.z] (JIRA:RHEL-296030)

    * RPCSEC_GSS context lifecycle leaks [rhel-9.9.z] (JIRA:RHEL-296039)

    * xdr_krb5_principal decode leak [rhel-9.9.z] (JIRA:RHEL-296051)

    * process_chpw_request leak [rhel-9.9.z] (JIRA:RHEL-296062)

    * Read overruns in GSSRPC svcauth_unix [rhel-9.9.z] (JIRA:RHEL-296073)

    * Null dereference in KDC dispatch corner case [rhel-9.9.z] (JIRA:RHEL-296085)

    * KDC DoS based on otherName value in PKINIT SAN code [rhel-9.9.z] (JIRA:RHEL-296103)

    * Memory leak on krb5 gss_accept_sec_context() failure [rhel-9.9.z] (JIRA:RHEL-296119)

    * KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers [rhel-9.9.z]     (JIRA:RHEL-296134)

    * Null dereference of principal names in krb5_rd_cred() [rhel-9.9.z] (JIRA:RHEL-297007)

    * Dereference of empty first credential list element in GSS mechanism [rhel-9.9.z] (JIRA:RHEL-297015)

    * Fix validation issues for trusted inputs [rhel-9.9.z] (JIRA:RHEL-299746)

    * Skip expired keys when iterating over KEYRING ccache [rhel-9.9.z] (JIRA:RHEL-299747)

    * Pass through null deleg_cred from SPNEGO to mech [rhel-9.9.z] (JIRA:RHEL-299748)

    * Fix leaks on error in PKINIT signed-data creation [rhel-9.9.z] (JIRA:RHEL-299749)

    * Fix hex key input handling in ktutil addent [rhel-9.9.z] (JIRA:RHEL-299750)

    * Check reply length before V4 reply check [rhel-9.9.z] (JIRA:RHEL-299751)

    * Fix memory leak in mpool_get() error paths [rhel-9.9.z] (JIRA:RHEL-299752)

    * json: Correctly abort parse on invalid array [rhel-9.9.z] (JIRA:RHEL-299753)

    * Prevent unsigned int overflow in iakerb_save_token() [rhel-9.9.z] (JIRA:RHEL-299754)

    * Fix ksu memory leak in fcmd_resolve() [rhel-9.9.z] (JIRA:RHEL-299755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:99715 advisory.

    * krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests     (CVE-2026-112323)

    * krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322)

    * krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)

    * krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request     (CVE-2026-71200)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths     (CVE-2026-112321)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching     (CVE-2026-112320)

    * krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

    * krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation     (CVE-2026-112319)

    * krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers     (CVE-2026-112318)

    * krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path     (CVE-2026-112317)

    * krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)

    * krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure     (CVE-2026-112316)

    * krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure     (CVE-2026-112315)

    * krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)

    * krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)

    * krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)

    * krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)

    * krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

    Bug Fix(es) and Enhancement(s):

    * Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-9.9.z] (JIRA:Rocky     Linux-278059)

    * auth_gssapi_wrap_data xdr_bytes failure leak [rhel-9.9.z] (JIRA:Rocky Linux-296018)

    * xdr_bytes() does not free its allocation on partial decode failure [rhel-9.9.z] (JIRA:Rocky     Linux-296030)

    * RPCSEC_GSS context lifecycle leaks [rhel-9.9.z] (JIRA:Rocky Linux-296039)

    * xdr_krb5_principal decode leak [rhel-9.9.z] (JIRA:Rocky Linux-296051)

    * process_chpw_request leak [rhel-9.9.z] (JIRA:Rocky Linux-296062)

    * Read overruns in GSSRPC svcauth_unix [rhel-9.9.z] (JIRA:Rocky Linux-296073)

    * Null dereference in KDC dispatch corner case [rhel-9.9.z] (JIRA:Rocky Linux-296085)

    * KDC DoS based on otherName value in PKINIT SAN code [rhel-9.9.z] (JIRA:Rocky Linux-296103)

    * Memory leak on krb5 gss_accept_sec_context() failure [rhel-9.9.z] (JIRA:Rocky Linux-296119)

    * KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers [rhel-9.9.z]     (JIRA:Rocky Linux-296134)

    * Null dereference of principal names in krb5_rd_cred() [rhel-9.9.z] (JIRA:Rocky Linux-297007)

    * Dereference of empty first credential list element in GSS mechanism [rhel-9.9.z] (JIRA:Rocky     Linux-297015)

    * Fix validation issues for trusted inputs [rhel-9.9.z] (JIRA:Rocky Linux-299746)

    * Skip expired keys when iterating over KEYRING ccache [rhel-9.9.z] (JIRA:Rocky Linux-299747)

    * Pass through null deleg_cred from SPNEGO to mech [rhel-9.9.z] (JIRA:Rocky Linux-299748)

    * Fix leaks on error in PKINIT signed-data creation [rhel-9.9.z] (JIRA:Rocky Linux-299749)

    * Fix hex key input handling in ktutil addent [rhel-9.9.z] (JIRA:Rocky Linux-299750)

    * Check reply length before V4 reply check [rhel-9.9.z] (JIRA:Rocky Linux-299751)

    * Fix memory leak in mpool_get() error paths [rhel-9.9.z] (JIRA:Rocky Linux-299752)

    * json: Correctly abort parse on invalid array [rhel-9.9.z] (JIRA:Rocky Linux-299753)

    * Prevent unsigned int overflow in iakerb_save_token() [rhel-9.9.z] (JIRA:Rocky Linux-299754)

    * Fix ksu memory leak in fcmd_resolve() [rhel-9.9.z] (JIRA:Rocky Linux-299755)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of krb5 installed on the remote host is prior to 1.22.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-313-01 advisory.

    New krb5 packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the krb5 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 8dc02503-dd51-11f1-a654-f8b46a88f42c advisory.

    The MIT KRB5 Project reports:
    An authenticated attacker can bypass authentication indicator                  enforcement by requesting a service ticket with fake CAMMAC                  authorization data.  Updating to the 1.22.3 release on the KDC                  is sufficient to prevent this attack.
    An authenticated attacker can bypass an application server's                  PAC authorization data checks by requesting a service ticket                  with a fake PAC.  Updating to the 1.22.3 release on either the                  KDC or the affected application server will prevent this                  attack.
    An authenticated attacker with administrative privileges can                  bypass the lockdown_keys attribute by using the password change                  protocol instead of the kadmin protocol to modify a principal's                  keys.
    The KDC, kadmind, and GSS-API application servers are all                  vulnerable to denial of service attacks by unauthenticated                  attackers.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99716 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    Security Fix(es):

    * krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests     (CVE-2026-112323)

    * krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322)

    * krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)

    * krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request     (CVE-2026-71200)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths     (CVE-2026-112321)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching     (CVE-2026-112320)

    * krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

    * krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation     (CVE-2026-112319)

    * krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers     (CVE-2026-112318)

    * krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path     (CVE-2026-112317)

    * krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)

    * krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure     (CVE-2026-112316)

    * krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure     (CVE-2026-112315)

    * krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)

    * krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)

    * krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)

    * krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)

    * krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

    Bug Fix(es) and Enhancement(s):

    * auth_gssapi_wrap_data xdr_bytes failure leak [rhel-9.8.z] (JIRA:RHEL-296016)

    * xdr_bytes() does not free its allocation on partial decode failure [rhel-9.8.z] (JIRA:RHEL-296028)

    * RPCSEC_GSS context lifecycle leaks [rhel-9.8.z] (JIRA:RHEL-296038)

    * xdr_krb5_principal decode leak [rhel-9.8.z] (JIRA:RHEL-296050)

    * process_chpw_request leak [rhel-9.8.z] (JIRA:RHEL-296060)

    * Read overruns in GSSRPC svcauth_unix [rhel-9.8.z] (JIRA:RHEL-296071)

    * Null dereference in KDC dispatch corner case [rhel-9.8.z] (JIRA:RHEL-296084)

    * KDC DoS based on otherName value in PKINIT SAN code [rhel-9.8.z] (JIRA:RHEL-296100)

    * Memory leak on krb5 gss_accept_sec_context() failure [rhel-9.8.z] (JIRA:RHEL-296117)

    * KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers [rhel-9.8.z]     (JIRA:RHEL-296132)

    * Null dereference of principal names in krb5_rd_cred() [rhel-9.8.z] (JIRA:RHEL-297005)

    * Dereference of empty first credential list element in GSS mechanism [rhel-9.8.z] (JIRA:RHEL-297013)

    * Fix validation issues for trusted inputs [rhel-9.8.z] (JIRA:RHEL-299756)

    * Skip expired keys when iterating over KEYRING ccache [rhel-9.8.z] (JIRA:RHEL-299758)

    * Pass through null deleg_cred from SPNEGO to mech [rhel-9.8.z] (JIRA:RHEL-299759)

    * Fix leaks on error in PKINIT signed-data creation [rhel-9.8.z] (JIRA:RHEL-299760)

    * Fix hex key input handling in ktutil addent [rhel-9.8.z] (JIRA:RHEL-299761)

    * Check reply length before V4 reply check [rhel-9.8.z] (JIRA:RHEL-299762)

    * Fix memory leak in mpool_get() error paths [rhel-9.8.z] (JIRA:RHEL-299763)

    * json: Correctly abort parse on invalid array [rhel-9.8.z] (JIRA:RHEL-299764)

    * Prevent unsigned int overflow in iakerb_save_token() [rhel-9.8.z] (JIRA:RHEL-299765)

    * Fix ksu memory leak in fcmd_resolve() [rhel-9.8.z] (JIRA:RHEL-299766)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:99624 advisory.

    * krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests     (CVE-2026-112323)

    * krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322)

    * krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)

    * krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request     (CVE-2026-71200)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths     (CVE-2026-112321)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching     (CVE-2026-112320)

    * krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

    * krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation     (CVE-2026-112319)

    * krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers     (CVE-2026-112318)

    * krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path     (CVE-2026-112317)

    * krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)

    * krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure     (CVE-2026-112316)

    * krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)

    * krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure     (CVE-2026-112315)

    * krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)

    * krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)

    * krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)

    * krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)

    * krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

    Bug Fix(es) and Enhancement(s):

    * Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-10.3.z] (JIRA:Rocky     Linux-278063)

    * auth_gssapi_wrap_data xdr_bytes failure leak [rhel-10.3.z] (JIRA:Rocky Linux-296012)

    * xdr_bytes() does not free its allocation on partial decode failure [rhel-10.3.z] (JIRA:Rocky     Linux-296023)

    * RPCSEC_GSS context lifecycle leaks [rhel-10.3.z] (JIRA:Rocky Linux-296034)

    * xdr_krb5_principal decode leak [rhel-10.3.z] (JIRA:Rocky Linux-296045)

    * process_chpw_request leak [rhel-10.3.z] (JIRA:Rocky Linux-296056)

    * Read overruns in GSSRPC svcauth_unix [rhel-10.3.z] (JIRA:Rocky Linux-296067)

    * Null dereference in KDC dispatch corner case [rhel-10.3.z] (JIRA:Rocky Linux-296081)

    * KDC DoS based on otherName value in PKINIT SAN code [rhel-10.3.z] (JIRA:Rocky Linux-296095)

    * Memory leak on krb5 gss_accept_sec_context() failure [rhel-10.3.z] (JIRA:Rocky Linux-296112)

    * KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers     [rhel-10.3.z] (JIRA:Rocky Linux-296127)

    * Dereference of empty first credential list element in GSS mechanism [rhel-10.3.z] (JIRA:Rocky     Linux-296997)

    * Null dereference of principal names in krb5_rd_cred() [rhel-10.3.z] (JIRA:Rocky Linux-297000)

    * Fix validation issues for trusted inputs [rhel-10.3.z] (JIRA:Rocky Linux-299144)

    * Skip expired keys when iterating over KEYRING ccache [rhel-10.3.z] (JIRA:Rocky Linux-299145)

    * Pass through null deleg_cred from SPNEGO to mech [rhel-10.3.z] (JIRA:Rocky Linux-299146)

    * Fix leaks on error in PKINIT signed-data creation [rhel-10.3.z] (JIRA:Rocky Linux-299147)

    * Fix hex key input handling in ktutil addent [rhel-10.3.z] (JIRA:Rocky Linux-299148)

    * Check reply length before V4 reply check [rhel-10.3.z] (JIRA:Rocky Linux-299149)

    * Fix memory leak in mpool_get() error paths [rhel-10.3.z] (JIRA:Rocky Linux-299150)

    * json: Correctly abort parse on invalid array [rhel-10.3.z] (JIRA:Rocky Linux-299151)

    * Prevent unsigned int overflow in iakerb_save_token() [rhel-10.3.z] (JIRA:Rocky Linux-299152)

    * Fix ksu memory leak in fcmd_resolve() [rhel-10.3.z] (JIRA:Rocky Linux-299153)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
478901	Alpine: krb5: security update to 1.22.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	11/10/2026	11/11/2026	high
478901	Alpine: krb5: security update to 1.22.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	11/10/2026	11/11/2026	high
379618	RHEL 10 : krb5 (RHSA-2026:99624)	Nessus	Red Hat Local Security Checks	11/12/2026	11/13/2026	high
379755	RHEL 10 : krb5 (RHSA-2026:99625)	Nessus	Red Hat Local Security Checks	11/12/2026	11/13/2026	high
379909	RHEL 9 : krb5 (RHSA-2026:99715)	Nessus	Red Hat Local Security Checks	11/12/2026	11/13/2026	high
380296	RockyLinux 9 : krb5 (RLSA-2026:99715)	Nessus	Rocky Linux Local Security Checks	11/13/2026	11/13/2026	high
378179	Linux Distros Unpatched Vulnerability : CVE-2026-107884	Nessus	Misc.	11/10/2026	11/12/2026	medium
377879	Slackware Linux 15.0 / current krb5 Multiple Vulnerabilities (SSA:2026-313-01)	Nessus	Slackware Local Security Checks	11/9/2026	11/13/2026	high
378786	FreeBSD : krb5 -- MIT krb5 Security Advisory 2026-001 (8dc02503-dd51-11f1-a654-f8b46a88f42c)	Nessus	FreeBSD Local Security Checks	11/11/2026	11/13/2026	high
379908	RHEL 9 : krb5 (RHSA-2026:99716)	Nessus	Red Hat Local Security Checks	11/12/2026	11/13/2026	high
380266	RockyLinux 10 : krb5 (RLSA-2026:99624)	Nessus	Rocky Linux Local Security Checks	11/13/2026	11/13/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

medium

high

high

high

high