{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119079", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-29T13:10:23.375Z", "datePublished": "2026-11-09T18:43:39.044Z", "dateUpdated": "2026-11-09T18:43:39.044Z"}, "containers": {"cna": {"title": "Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}, {"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:hummingbird:1"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-119079", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479231", "name": "RHBZ#2479231", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-11-09T15:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-408", "description": "Incorrect Behavior Order: Early Amplification", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-408: Incorrect Behavior Order: Early Amplification", "workarounds": [{"lang": "en", "value": "Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld.\n\n1. Add a rich rule permitting TCP port 88 only from trusted networks (substitute with the appropriate network CIDR):\nfirewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"192.168.1.0/24\" port port=\"88\" protocol=\"tcp\" accept'\n\n2. Ensure unauthenticated or public access to port 88/tcp is removed:\nfirewall-cmd --permanent --remove-port=88/tcp\n\n3. Apply the changes:\nfirewall-cmd --reload\n\nWarning: Applying firewall changes requires reloading firewalld, which may temporarily disrupt network traffic. Restricting TCP access will prevent clients outside the allowed network range from falling back to TCP for large Kerberos ticket exchanges."}], "timeline": [{"lang": "en", "time": "2026-05-18T03:32:25.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-09T15:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by AISLE Research and Found by AISLE in partnership with Red Hat."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-09T18:43:39.044Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{}

{}

{}