DEBIAN-CVE-2026-107778

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-107778
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-107778.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-107778
Upstream
Published
2026-10-08T21:17:52Z
Modified
2026-10-09T11:00:06Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

References

Affected packages

Debian:12 / krb5

Package

Name
krb5
Purl
pkg:deb/debian/krb5?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.20.1-2
1.20.1-2+deb12u1
1.20.1-2+deb12u2
1.20.1-2+deb12u3
1.20.1-2+deb12u4
1.20.1-2+deb12u5
1.20.1-2+loong64
1.20.1-3
1.20.1-4
1.20.1-5
1.20.1-5.1~exp1
1.20.1-5.1
1.20.1-6
1.21.2-1
1.21.3-1
1.21.3-2
1.21.3-3
1.21.3-4
1.21.3-5
1.22.1-1
1.22.1-2
1.22.1-2.1
1.22.1-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-107778.json"

Debian:13 / krb5

Package

Name
krb5
Purl
pkg:deb/debian/krb5?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.21.3-5
1.21.3-5+deb13u1
1.22.1-1
1.22.1-2
1.22.1-2.1
1.22.1-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-107778.json"

Debian:14 / krb5

Package

Name
krb5
Purl
pkg:deb/debian/krb5?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.21.3-5
1.22.1-1
1.22.1-2
1.22.1-2.1
1.22.1-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-107778.json"