CVE-2026-123975 · Package
NO FIX YET · SEE WHAT TO DO
Grid Community Toolkit's globus-gss-assist library writes outside a heap buffer when an SSLv2 record length below 3 is received. A remote unauthenticated client can send a crafted GSI handshake record to services such as globus-gatekeeper and myproxy to corrupt heap memory and crash the service.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running Grid Community Toolkit services that use globus-gss-assist, such as globus-gatekeeper and myproxy, are exposed when they accept GSI handshake connections from the network. Sources do not say whether non-default configuration is required.
Not affected if no-globus-gss-assist
Who cares globus, globus-gatekeeper, grid-computing, gsi, myproxy
6.2.20261111 or later12.9 or laterGrid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in globus_gss_assist_token_get_fd() triggered by SSLv2 record lengths below 3. Remote unauthenticated clients can send a crafted GSI handshake record to services like globus-gatekeeper and myproxy to corrupt heap memory and crash the service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.