{"id":"CVE-2026-119079","kind":"vulnerability","aliases":["CVE-2026-119079"],"related":[],"title":"MIT Kerberos: unauthenticated requests over TCP can exhaust KDC CPU","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.","summary":"MIT Kerberos 5 (krb5) 1.11 and later grows a decoded element array one entry at a time in decode_sequence_of(). A remote attacker can send an unauthenticated AS-REQ or TGS-REQ over TCP with a very large SEQUENCE OF field to consume CPU on the KDC and cause denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"krb5","fixed":["1.22.3"],"affected":"< 1.22.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["active-directory-adjacent","infrastructure","kdc","kerberos","mit-kerberos","self-hosted"],"not_affected_if":["active-directory-only","managed-hosting","no-kdc-running","udp-only"],"how_to_check":"Run a KDC? Check the version: 'krb5-config --version' or your package manager (e.g. rpm -q krb5-server, dpkg -l krb5-kdc). Anything older than 1.22.3 that runs krb5kdc and accepts TCP (port 88) is in scope; the advisory does not give an exact lower bound (NVD summary says 1.11 and later). Distro builds may carry the patch without the version number changing.","fix":"Upgrade MIT krb5 to 1.22.3 (MITKRB5-SA-2026-001). Distro packages: install your vendor's backport of this advisory.","status":"open","published_at":"2026-11-09T19:16:43+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","triaged_at":"2026-11-09T19:29:38+00:00","updated_at":"2026-11-09T19:36:11+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-09T19:29:38Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"MIT Kerberos: unauthenticated requests over TCP can exhaust KDC CPU","impact":"medium","summary":"MIT Kerberos 5 (krb5) 1.11 and later grows a decoded element array one entry at a time in decode_sequence_of(). A remote attacker can send an unauthenticated AS-REQ or TGS-REQ over TCP with a very large SEQUENCE OF field to consume CPU on the KDC and cause denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kerberos","mit-kerberos","kdc","active-directory-adjacent"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"KDC CPU exhausted, causing denial of service to authentication","analyst_note":"Confirm affected version range and fixed release from the MIT krb5 advisory; the NVD entry gives no fix or check details.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-kdc-running","udp-only"],"who_is_affected":"Any deployment running the MIT Kerberos KDC from krb5 1.11 or later that accepts TCP requests from the network is exposed, since the attack needs no credentials. Sources do not state which configurations or KDC builds are affected beyond that version range. Organisations that do not run a Kerberos KDC can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4626,"output_tokens":546,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected version range and fixed release from the MIT krb5 advisory; the NVD entry gives no fix or check details.","search":"'-119079':13A,16A '-2026':12A,15A '1.11':35B,97C '5':33B,94C 'activ':19B 'active-directory-adjac':18B 'adjac':21B 'aka':95C 'allow':111C 'array':42B,104C 'as-req':59B,129C 'attack':54B,113C 'caus':82B,115C 'consum':76B 'consumpt':121C 'cpu':10A,77B,120C 'cve':11A,14A 'decod':40B,49B,86C,102C 'denial':83B,117C 'directori':20B 'element':41B,103C,141C 'entri':44B,106C 'exhaust':8A 'field':74B,146C 'grow':38B,100C 'host':30B 'infrastructur':22B 'kdc':9A,23B,80B,124C 'kerbero':2A,24B,27B,32B,93C 'krb5':17A,34B,96C 'larg':71B,138C 'later':37B,99C 'lib/krb5/asn.1/asn1_encode.c':90C 'mit':1A,26B,31B,92C 'mit-kerbero':25B 'number':139C 'one':43B,105C 'remot':53B,112C 'req':61B,65B,131C,135C 'request':4A 'self':29B 'self-host':28B 'send':56B,126C 'sequenc':50B,72B,87C,144C 'servic':85B,119C 'tcp':6A,67B,148C 'tgs':64B,134C 'tgs-req':63B,133C 'time':47B,109C 'unauthent':3A,58B,128C","nicknames":[],"mitigations":[],"who_affected":"Teams that run their own MIT Kerberos KDC (krb5kdc) reachable over TCP, including Linux/Unix realms and appliances built on MIT krb5. An unauthenticated client can send an oversized AS-REQ or TGS-REQ to burn KDC CPU, which can block logins. Active Directory domain controllers and managed Kerberos services do not run this code and can skip it; so can KDCs not reachable by untrusted clients.","tier":"B","verified":{"fix":{"at":"2026-11-09T19:36:11Z","by":"analyst","doc":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","run_id":2337}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["krb5"],"ptokens":["krb5"],"labels":["activedirectoryadjacent","high","infrastructure","kdc","kerberos","mitkerberos","selfhosted"],"campaign_type":null,"search_a":"'-119079':13A,16A '-2026':12A,15A 'cpu':10A 'cve':11A,14A 'exhaust':8A 'kdc':9A 'kerbero':2A 'krb5':17A 'mit':1A 'request':4A 'tcp':6A 'unauthent':3A","search_b":"'1.11':35B '5':33B 'activ':19B 'active-directory-adjac':18B 'adjac':21B 'array':42B 'as-req':59B 'attack':54B 'caus':82B 'consum':76B 'cpu':77B 'decod':40B,49B 'denial':83B 'directori':20B 'element':41B 'entri':44B 'field':74B 'grow':38B 'host':30B 'infrastructur':22B 'kdc':23B,80B 'kerbero':24B,27B,32B 'krb5':34B 'larg':71B 'later':37B 'mit':26B,31B 'mit-kerbero':25B 'one':43B 'remot':53B 'req':61B,65B 'self':29B 'self-host':28B 'send':56B 'sequenc':50B,72B 'servic':85B 'tcp':67B 'tgs':64B 'tgs-req':63B 'time':47B 'unauthent':58B","search_c":"'1.11':97C '5':94C 'aka':95C 'allow':111C 'array':104C 'as-req':129C 'attack':113C 'caus':115C 'consumpt':121C 'cpu':120C 'decod':86C,102C 'denial':117C 'element':103C,141C 'entri':106C 'field':146C 'grow':100C 'kdc':124C 'kerbero':93C 'krb5':96C 'larg':138C 'later':99C 'lib/krb5/asn.1/asn1_encode.c':90C 'mit':92C 'number':139C 'one':105C 'remot':112C 'req':131C,135C 'send':126C 'sequenc':87C,144C 'servic':119C 'tcp':148C 'tgs':134C 'tgs-req':133C 'time':109C 'unauthent':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","severity":null,"published_at":"2026-11-09T19:16:43+00:00","modified_at":"2026-11-09T19:16:43+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","fetched_at":"2026-11-09T19:28:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119079:2337","url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","severity":null,"published_at":"2026-11-09T19:36:11+00:00","modified_at":"2026-11-09T19:36:11+00:00","first_seen_at":"2026-11-09T19:36:11+00:00","fetched_at":"2026-11-09T19:36:11+00:00","note":"MIT advisory MITKRB5-SA-2026-001 lists this CVE under Denial of Service, fixed in 1.22.3; it gives no affected-version lower bound and no workaround. The decode_sequence_of detail and 1.11+ range come from the NVD summary only, not verified. Exa search and X were not used (credits exhausted); NVD page did not load. No exploitation or PoC found.","cites":["https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt"]}],"documents":[{"id":109492,"url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","title":"MITKRB5-SA-2026-001: Multiple vulnerabilities fixed in 1.22.3","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}