UBUNTU-CVE-2026-116497

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-116497
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116497.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-116497
Upstream
  • CVE-2026-116497
Published
2026-10-26T15:16:00Z
Modified
2026-10-28T20:17:33Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.

References

Affected packages

Ubuntu:18.04:LTS
gssproxy

Package

Name
gssproxy
Purl
pkg:deb/ubuntu/gssproxy?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.5.1-2
0.7.0+git20171223-2
0.8.0-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "gssproxy",
            "binary_version":  "0.8.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116497.json"
Ubuntu:20.04:LTS
gssproxy

Package

Name
gssproxy
Purl
pkg:deb/ubuntu/gssproxy?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.8.0-1.1
0.8.2-1
0.8.2-2
0.8.2-2ubuntu0.20.04.1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "gssproxy",
            "binary_version":  "0.8.2-2ubuntu0.20.04.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116497.json"
Ubuntu:22.04:LTS
gssproxy

Package

Name
gssproxy
Purl
pkg:deb/ubuntu/gssproxy?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.8.4-1
0.8.4-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "gssproxy",
            "binary_version":  "0.8.4-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116497.json"
Ubuntu:24.04:LTS
gssproxy

Package

Name
gssproxy
Purl
pkg:deb/ubuntu/gssproxy?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.1-1
0.9.2-1
0.9.2-2
0.9.2-2build1
0.9.2-2build2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "gssproxy",
            "binary_version":  "0.9.2-2build2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116497.json"
Ubuntu:26.04:LTS
gssproxy

Package

Name
gssproxy
Purl
pkg:deb/ubuntu/gssproxy?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.2-3
0.9.2-4

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "gssproxy",
            "binary_version":  "0.9.2-4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116497.json"
Ubuntu:26.10
gssproxy

Package

Name
gssproxy
Purl
pkg:deb/ubuntu/gssproxy?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.2-4
0.9.2-5

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "gssproxy",
            "binary_version":  "0.9.2-5"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116497.json"