CVE-2026-107778

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107778
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107778.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107778
Downstream
AZL (1)
BELL (1)
CLSA (2)
DEBIAN (1)
ECHO (1)
OESA (4)
openSUSE (1)
RHSA (1)
ROOT (2)
SUSE (1)
UBUNTU (1)
Related
Published
2026-10-08T20:15:54Z
Modified
2026-10-28T17:27:14Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
Details

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107778.json"
}
References

Affected packages

Git / github.com/krb5/krb5

Affected ranges

Type
GIT
Repo
https://github.com/krb5/krb5
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
48afa9abb89ab2176bb20624d87d010b9984fc08
Fixed
62196e2b269159a5465f5b8d0ed7cf6f29c3282a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.22.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "48afa9abb89ab2176bb20624d87d010b9984fc08"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "62196e2b269159a5465f5b8d0ed7cf6f29c3282a"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

kfw-4.*
kfw-4.4-beta1
krb5-1.*
krb5-1.22-beta1
krb5-1.22-final
krb5-1.22.1-final
krb5-1.22.2-final

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107778.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "286374493882982941487906000443605541520",
            "length":  1356
        },
        "id":  "CVE-2026-107778-23cc1271",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08",
        "target":  {
            "file":  "src/lib/krb5/krb/rd_cred.c",
            "function":  "make_cred_list"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "212371921237095351900881103152023042208",
                "325422404331133016558138455629542180535",
                "129886976803719205381817672549968958873",
                "62632468203456634975357534468703969001"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107778-4a08896e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08",
        "target":  {
            "file":  "src/lib/krb5/krb/rd_cred.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "212371921237095351900881103152023042208",
                "325422404331133016558138455629542180535",
                "129886976803719205381817672549968958873",
                "62632468203456634975357534468703969001"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-107778-d523cd8e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a",
        "target":  {
            "file":  "src/lib/krb5/krb/rd_cred.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "286374493882982941487906000443605541520",
            "length":  1356
        },
        "id":  "CVE-2026-107778-ffc8aac4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a",
        "target":  {
            "file":  "src/lib/krb5/krb/rd_cred.c",
            "function":  "make_cred_list"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:08Z"