DEBIAN-CVE-2026-116497

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-116497
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-116497.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-116497
Upstream
  • CVE-2026-116497
Published
2026-10-26T15:16:40Z
Modified
2026-10-27T05:00:07Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.

References

Affected packages

Debian:12 / gssproxy

Package

Name
gssproxy
Purl
pkg:deb/debian/gssproxy?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.1-1
0.9.2-1
0.9.2-2
0.9.2-3
0.9.2-4
0.9.2-5~exp0
0.9.2-5

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-116497.json"

Debian:13 / gssproxy

Package

Name
gssproxy
Purl
pkg:deb/debian/gssproxy?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.2-3
0.9.2-4
0.9.2-5~exp0
0.9.2-5

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-116497.json"

Debian:14 / gssproxy

Package

Name
gssproxy
Purl
pkg:deb/debian/gssproxy?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.2-3
0.9.2-4
0.9.2-5~exp0
0.9.2-5

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-116497.json"