There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read
    if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in
    /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to
    terminate in parse_message. (CVE-2026-40356)

  - MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's
    get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed
    names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC
    carrying a malformed client name to crash krb5kdc and deny authentication. (CVE-2026-107708)

  - decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the
    decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU
    consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in
    a SEQUENCE OF field over TCP. (CVE-2026-119079)

  - The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not
    reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a
    denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty
    policy name that reaches authorization checks or logging code. (CVE-2026-112318)

  - krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free
    decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial
    of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption
    failures. (CVE-2026-112317)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier     between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client     programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
    (CVE-2026-112314)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of krb5 installed on the remote host is prior to 1.22.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-313-01 advisory.

    New krb5 packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the krb5 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
478901	Alpine: krb5: security update to 1.22.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	11/10/2026	11/10/2026	high
478901	Alpine: krb5: security update to 1.22.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	11/10/2026	11/10/2026	high
377875	Linux Distros Unpatched Vulnerability : CVE-2026-112314	Nessus	Misc.	11/9/2026	11/10/2026	high
377879	Slackware Linux 15.0 / current krb5 Multiple Vulnerabilities (SSA:2026-313-01)	Nessus	Slackware Local Security Checks	11/9/2026	11/9/2026	high

Detections

Analytics

Plugins Search

high

high

high

high