CVE-2025-59089: kdcproxy Denial of Service Vulnerability

CVE-2025-59089 Overview

CVE-2025-59089 is a denial-of-service vulnerability in kdcproxy, the Kerberos Key Distribution Center (KDC) proxy service maintained by the Latchset project. The flaw allows an attacker who can influence the KDC destination, for example through server-side request forgery (SSRF), to exhaust memory and CPU on the proxy host. kdcproxy fails to enforce bounds on TCP response length and reallocates the entire buffered stream on each recv() call. An attacker-controlled KDC can send unbounded chunks until the connection timeout expires, degrading service for legitimate Kerberos clients.

Critical Impact
Unbounded TCP response buffering in kdcproxy allows an attacker-controlled KDC to exhaust proxy memory and CPU, and concurrent requests can overflow the accept queue, denying Kerberos authentication service to legitimate clients.

Affected Products

kdcproxy (latchset/kdcproxy) prior to the patched revision
Red Hat Enterprise Linux packages tracked in advisories RHSA-2025:21138 through RHSA-2025:22982
Identity Management (IdM/FreeIPA) deployments that expose kdcproxy for MS-KKDCP

Discovery Timeline

2025-11-12 - CVE-2025-59089 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-59089

Vulnerability Analysis

The vulnerability is classified under [CWE-770: Allocation of Resources Without Limits or Throttling]. kdcproxy acts as an HTTP-to-Kerberos proxy that forwards MS-KKDCP requests to a backend KDC over TCP. When receiving the KDC response, the proxy accumulates data in a per-socket buffer and does not enforce the maximum Kerberos message length declared in the KKDCP framing header.

Two behaviors combine to make exploitation possible. First, on every recv() iteration the proxy copies the entire buffered stream into a new buffer, producing quadratic memory and CPU consumption as data grows. Second, the receive loop only terminates when the received length exactly matches the header-declared length, so a malicious KDC can send chunks that overshoot the declared size and continue transmitting until the roughly 12-second connection timeout is reached.

With multiple concurrent requests, the socket accept queue overflows and new client connections are refused. The result is a network-reachable resource exhaustion condition against Kerberos infrastructure.

Root Cause

The root cause is missing length enforcement in the TCP receive loop of kdcproxy/__init__.py. The proxy trusts the upstream KDC to terminate the stream cleanly and never validates that per-chunk or total buffered bytes remain within the maximum Kerberos message size. Additionally, buffers for broken TCP sockets were not removed from the internal read_buffers map, contributing to memory retention.

Attack Vector

Exploitation requires that kdcproxy connect to a KDC endpoint controlled by the attacker. This is achievable when the proxy configuration accepts realm-to-KDC mappings from untrusted input, or through SSRF primitives in adjacent services. Once connected, the malicious KDC streams oversized or non-terminating responses to trigger memory growth, CPU consumption, and accept queue exhaustion. No authentication is required to abuse the proxy path.

python

# Patch excerpt from kdcproxy/__init__.py
                     if self.sock_type(sock) == socket.SOCK_STREAM:
                         # Remove broken TCP socket from readers
                         rsocks.remove(sock)
+                        read_buffers.pop(sock)
                 else:
                     if reply is not None:
                         return reply
# Source: https://github.com/latchset/kdcproxy/commit/c7675365aa20be11f03247966336c7613cac84e1

The patch ensures that when a TCP socket is removed from the reader set, its associated buffer is also released. The upstream fix additionally enforces bounds on inbound response length. See the GitHub commit and Pull Request #68 for the complete change set.

Detection Methods for CVE-2025-59089

Indicators of Compromise

Sustained high memory or CPU usage in the kdcproxy process without a corresponding increase in successful Kerberos authentications
Repeated outbound TCP sessions from kdcproxy to unusual or externally routable KDC addresses
Kerberos client failures and TCP SYN backlog growth on the proxy host coincident with proxy resource spikes

Detection Strategies

Monitor kdcproxy process resource metrics (RSS, CPU time) and alert on anomalous growth over short intervals
Inspect kdcproxy configuration and logs for realm-to-KDC mappings that resolve to attacker-controllable hosts
Correlate accept queue overflows (ListenOverflows, ListenDrops in /proc/net/netstat) with proxy activity

Monitoring Recommendations

Ship kdcproxy and web server logs to a centralized analytics platform and alert on abnormal upstream KDC destinations
Track TCP connection duration to KDC backends; sessions approaching the 12-second timeout warrant investigation
Baseline normal MS-KKDCP request volume and alert on concurrency spikes that could indicate accept queue exhaustion

How to Mitigate CVE-2025-59089

Immediate Actions Required

Apply the vendor-supplied kdcproxy update from the applicable Red Hat advisory (RHSA-2025:21138 through RHSA-2025:22982)
Restrict kdcproxy outbound connectivity to a known allow-list of internal KDC addresses using host or network firewalls
Review kdcproxy.conf and any dynamic realm resolution to ensure attacker-controlled hosts cannot be selected as upstream KDCs

Patch Information

The upstream fix is available in the latchset/kdcproxy commit c7675365. Red Hat has released updated packages across multiple product streams; consult the Red Hat CVE record for CVE-2025-59089 and the Red Hat Bug Report #2393958 for stream-specific errata such as RHSA-2025:21448 and RHSA-2025:21748.

Workarounds

Place kdcproxy behind a reverse proxy or WAF that enforces request and response size limits on the KKDCP HTTP path
Use egress filtering to prevent kdcproxy from initiating TCP sessions to any host outside the trusted KDC set
Apply operating system resource limits (systemdMemoryMax, TasksMax) to the kdcproxy service to contain resource exhaustion

bash

# Example systemd drop-in to constrain kdcproxy resources
# /etc/systemd/system/kdcproxy.service.d/limits.conf
[Service]
MemoryMax=512M
TasksMax=256
LimitNOFILE=1024