Medium severity5.9NVD Advisory· Published Apr 28, 2026· Updated Jul 14, 2026
CVE-2026-40355
CVE-2026-40355
Description
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
16cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*range: >=1.18.0,<=1.22.2
- (no CPE)range: <1.22.3
- Range: <1.22.3
- osv-coords12 versionspkg:rpm/almalinux/krb5-develpkg:rpm/almalinux/krb5-libspkg:rpm/almalinux/krb5-pkinitpkg:rpm/almalinux/krb5-serverpkg:rpm/almalinux/krb5-server-ldappkg:rpm/almalinux/krb5-workstationpkg:rpm/almalinux/krb5-xrealmauthzpkg:rpm/almalinux/libkadm5pkg:rpm/opensuse/krb5&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/krb5&distro=openSUSE%20Tumbleweedpkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Micro%205.4
< 1.18.2-34.el8_10+ 11 more
- (no CPE)range: < 1.18.2-34.el8_10
- (no CPE)range: < 1.18.2-34.el8_10
- (no CPE)range: < 1.18.2-34.el8_10
- (no CPE)range: < 1.18.2-34.el8_10
- (no CPE)range: < 1.18.2-34.el8_10
- (no CPE)range: < 1.18.2-34.el8_10
- (no CPE)range: < 1.21.3-10.el10_2
- (no CPE)range: < 1.18.2-34.el8_10
- (no CPE)range: < 1.21.3-160000.3.1
- (no CPE)range: < 1.22.2-3.1
- (no CPE)range: < 1.19.2-150400.3.21.1
- (no CPE)range: < 1.19.2-150400.3.21.1
Patches
Vulnerability mechanics
References
5- github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929fnvdPatch
- cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.htmlnvdExploitPatchThird Party Advisory
- web.mit.edu/kerberos/advisories/nvdVendor Advisory
- cert-portal.siemens.com/productcert/html/ssa-019113.htmlnvd
- cert-portal.siemens.com/productcert/html/ssa-082556.htmlnvd
News mentions
1- Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPCISA ICS Advisories