CVE-2026-107778
published 2026-10-08CVE-2026-107778: MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash…
PriorityP334medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
35.6th percentile
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| migration-toolkit-virtualization | mtv-virt-v2v-rhel10 | — | — |
| mit | krb5 | <= 1.22.2 | — |
| mit | krb5 | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| openshift4 | driver-toolkit-rhel9 | — | — |
| openshift4 | ose-ironic-machine-os-downloader-rhel9 | — | — |
| rhcertification | redhat-certification-baremetal | — | — |
| rhcertification | redhat-certification-system-ai-10 | — | — |
| rhcertification | redhat-certification-system-ai-9 | — | — |
| rhel10-eus | rhel-10.0-bootc | — | — |
| rhel10-eus | rhel-10.2-bootc | — | — |
| rhel10 | rhel-bootc | — | — |
| rhel9-eus | rhel-9.6-bootc | — | — |
| rhel9-eus | rhel-9.8-bootc | — | — |
| rhel9 | rhel-bootc | — | — |
| rhoso | openstack-nova-compute-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MIT Kerberos 5 up to 1.22.2 rd_cred.c make_cred_list null pointer dereference (Nessus ID 364715 / WID-SEC-2026-3836)
vuldb·2026-10-13·CVSS 6.5
CVE-2026-107778 [MEDIUM] MIT Kerberos 5 up to 1.22.2 rd_cred.c make_cred_list null pointer dereference (Nessus ID 364715 / WID-SEC-2026-3836)
A vulnerability identified as critical has been detected in MIT Kerberos 5 up to 1.22.2. Impacted is the function make_cred_list of the file rd_cred.c. This manipulation causes null pointer dereference.
This vulnerability is registered as CVE-2026-107778. Remote exploitation of the attack is possible. No exploit is available.
GHSA
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED ar
ghsa_unreviewed·2026-10-08
CVE-2026-107778 [HIGH] CWE-476 MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED ar
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Red Hat
krb5: krb5: Denial of Service via crafted forwarded credentials
vendor_redhat·2026-10-08·CVSS 6.5
CVE-2026-107778 [MEDIUM] CWE-476 krb5: krb5: Denial of Service via crafted forwarded credentials
krb5: krb5: Denial of Service via crafted forwarded credentials
A flaw was found in krb5. An authenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted forwarded credentials containing mismatched credential entries. This improper handling triggers a null pointer dereference, causing the service to crash and become unavailable.
Package: migration-toolkit-virtualization/mtv-virt-v2v-rhel10 (Migration Toolkit for Virtualization) - Fix deferred
Package: rhcertification/redhat-certification-baremetal (Red Hat Certification Program for Red Hat Enterprise Linux 9) - Fix deferred
Package: rhcertification/redhat-certification-system-ai-10 (Red Hat Certification Program for Red Hat Enterprise Linux 9) - Fix deferred
Package: rhcertification/redhat-certificati
No detection rules found.
No public exploits indexed.
https://github.com/krb5/krb5https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282ahttps://github.com/krb5/krb5/pull/1511https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred
2026-10-08
Published