OESA-2026-4826

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4826

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-4826.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-4826

Upstream

CVE-2026-116497

Published

2026-11-11T12:26:34Z

Modified

2026-11-11T12:45:11Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

gssproxy security update

Details

This is a proxy for GSSAPI which deals with credential handling

Security Fix(es):

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.(CVE-2026-116497)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:24.03-LTS-SP1 / gssproxy

Package

Name: gssproxy
Purl: pkg:rpm/openEuler/gssproxy&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.9.2-9.oe2403sp1

Ecosystem specific

{
    "aarch64": [
        "gssproxy-0.9.2-9.oe2403sp1.aarch64.rpm",
        "gssproxy-debuginfo-0.9.2-9.oe2403sp1.aarch64.rpm",
        "gssproxy-debugsource-0.9.2-9.oe2403sp1.aarch64.rpm"
    ],
    "noarch": [
        "gssproxy-help-0.9.2-9.oe2403sp1.noarch.rpm"
    ],
    "src": [
        "gssproxy-0.9.2-9.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "gssproxy-0.9.2-9.oe2403sp1.x86_64.rpm",
        "gssproxy-debuginfo-0.9.2-9.oe2403sp1.x86_64.rpm",
        "gssproxy-debugsource-0.9.2-9.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-4826.json"