---
id: "CVE-2026-116497"
kind: "vulnerability"
aliases: ["CVE-2026-116497"]
title: "gssproxy: missing target_name crashes daemon, persistent denial of service"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["gssproxy", "idm", "infrastructure", "kerberos", "linux", "nfs"]
not_affected_if: ["gssproxy-not-installed"]
published_at: "2026-10-26T15:16:40+00:00"
first_seen_at: "2026-10-26T16:02:25+00:00"
updated_at: "2026-10-26T16:03:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116497", "first_seen_at": "2026-10-26T16:02:25+00:00"}]
---

# gssproxy: missing target_name crashes daemon, persistent denial of service

A request to gssproxy's GSSX_INIT_SEC_CONTEXT call with the target_name field absent causes a NULL pointer dereference that crashes the daemon. Any local user can send it through the Unix socket without authentication, and the daemon does not restart on its own, which also disrupts services that depend on it such as Kerberized NFS and IdM.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-26T16:02:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116497

## From the sources

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_