{"id":"CVE-2026-116497","kind":"vulnerability","aliases":["CVE-2026-116497"],"related":[],"title":"gssproxy: missing target_name crashes daemon, persistent denial of service","description":"A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.","summary":"A request to gssproxy's GSSX_INIT_SEC_CONTEXT call with the target_name field absent causes a NULL pointer dereference that crashes the daemon. Any local user can send it through the Unix socket without authentication, and the daemon does not restart on its own, which also disrupts services that depend on it such as Kerberized NFS and IdM.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gssproxy","idm","infrastructure","kerberos","linux","nfs"],"not_affected_if":["gssproxy-not-installed"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T15:16:40+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:03:50+00:00","updated_at":"2026-10-26T16:03:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T16:03:50Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"gssproxy: missing target_name crashes daemon, persistent denial of service","impact":"low","summary":"A request to gssproxy's GSSX_INIT_SEC_CONTEXT call with the target_name field absent causes a NULL pointer dereference that crashes the daemon. Any local user can send it through the Unix socket without authentication, and the daemon does not restart on its own, which also disrupts services that depend on it such as Kerberized NFS and IdM.","category":"infrastructure","nicknames":[],"who_cares":["gssproxy","kerberos","nfs","idm","linux"],"confidence":0.6,"needs_auth":"no","worst_case":"local user crashes gssproxy, persistent denial of service","analyst_note":"Find the affected and fixed gssproxy versions and a check for the daemon version, using the NVD entry and the upstream gssproxy project.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["gssproxy-not-installed"],"who_is_affected":"Systems running the gssproxy daemon with its Unix socket reachable by local users, including hosts that serve Kerberized NFS or IdM. Hosts where gssproxy is not installed or not running are not affected. The sources do not give affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000579,"input_tokens":3365,"output_tokens":485,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116497':13A,16A '-2026':12A,15A 'absent':38B,106C 'affect':149C 'allow':121C 'also':70B,148C 'authent':59B,120C 'automat':138C 'call':32B 'caus':39B 'context':31B,97C 'crash':5A,45B,115C,126C 'cve':11A,14A 'daemon':6A,47B,62B,108C,129C,135C 'denial':8A,144C 'depend':74B,150C 'derefer':43B,86C,109C 'disrupt':71B 'field':37B,105C 'found':89C 'gssproxi':1A,17B,26B,91C,128C 'gssx':28B,94C 'idm':18B,82B,157C 'infrastructur':19B 'init':29B,95C 'kerber':79B,154C 'kerbero':20B 'linux':21B 'local':49B,123C 'miss':2A 'name':4A,36B,104C 'nfs':22B,80B,155C 'null':41B,84C,112C 'persist':7A,143C 'pointer':42B,85C,113C 'receiv':100C 'request':24B,98C,117C 'requir':118C 'restart':65B,139C 'result':111C,140C 'sec':30B,96C 'send':52B 'servic':10A,72B,146C,151C 'socket':57B,133C 'target':3A,35B,103C 'unix':56B,132C 'user':50B,124C 'via':130C 'vulner':87C 'without':58B","nicknames":[],"mitigations":[],"who_affected":"Systems running the gssproxy daemon with its Unix socket reachable by local users, including hosts that serve Kerberized NFS or IdM. Hosts where gssproxy is not installed or not running are not affected. The sources do not give affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116497","severity":null,"published_at":"2026-10-26T15:16:40+00:00","modified_at":"2026-10-26T15:16:40+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}