Medium severity5.9NVD Advisory· Published Apr 28, 2026· Updated Apr 28, 2026

CVE-2026-40355

Description

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

Affected products

Krb5/Krb5references

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.htmlnvd
github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929fnvd
web.mit.edu/kerberos/advisories/nvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000