Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 40/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
MIT Kerberos 5 (krb5) is affected by a flaw in the Key Distribution Center (KDC) that lets an attacker exhaust the server's CPU and cause a denial of service. The attacker can do this remotely, without logging in, by sending a crafted unauthenticated AS-REQ or TGS-REQ over TCP that contains a SEQUENCE OF field with a large number of elements.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure17/25No login or user action needed, reachable over the network without a login · Unknown: Advisories don't say whether default setups are affected
- Reach10/20Shipped in major Linux distributions
- Severity7.5/10CVSS 7.5
- No patch5/5No patch listed yet
What would change the score
- Would score about 85 if added to CISA KEV
- Would score about 80 if CISA's SSVC rates exploitation active
- Would score about 45 if advisories confirm default setups are exposed
What to do
Workaround: Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-119079
Is CVE-2026-119079 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The MIT Kerberos key distribution center (KDC) can be made to use a large amount of CPU by a remote client that sends a message containing a very large number of elements in an ASN.1 SEQUENCE OF field over TCP. The KDC's decoder grows the element array one entry at a time, which makes the processing cost rise quadratically, so the service can be slowed or made unresponsive.Source: access.redhat.com, bugzilla.redhat.com
Am I affected, and how do I check?
The issue is reported in MIT Kerberos 5 (krb5) version 1.11 and later, when the KDC accepts TCP connections on port 88. To check, run the KDC's version command (for example, krb5kdc -V) and confirm whether the KDC listens for TCP on port 88. Red Hat Enterprise Linux 6, 7, 8, 9 and 10 and Red Hat Hardened Images are listed as products, but no fixed versions are given.Source: access.redhat.com, bugzilla.redhat.com
How do I fix CVE-2026-119079?
No fixed version is listed in the available information, so no specific upgrade target can be given yet. Watch the Red Hat advisory for a fixed package and apply it when it is released.Source: access.redhat.com, bugzilla.redhat.com
What if there's no patch?
Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts, for example with firewalld. This limits who can reach the KDC over TCP while no fix is available.Source: access.redhat.com, bugzilla.redhat.com