CVE-2026-107778: MIT Kerberos 5 DOS Vulnerability

CVE-2026-107778 Overview

CVE-2026-107778 is a NULL pointer dereference vulnerability [CWE-476] in MIT Kerberos 5 (krb5) through version 1.22.2. The flaw resides in the make_cred_list() function inside src/lib/krb5/krb/rd_cred.c. Authenticated Kerberos clients can crash GSS-API acceptor services by sending a KRB-CRED message where the ticket array contains more entries than the corresponding ticket_info array. When processed through gss_accept_sec_context(), the mismatch triggers a NULL dereference and terminates the service, resulting in denial of service.

Critical Impact
Authenticated attackers can crash any GSS-API acceptor service that processes forwarded Kerberos credentials, disrupting authentication across dependent applications.

Affected Products

MIT Kerberos 5 (krb5) all versions through 1.22.2
Applications and services linking the libkrb5 library and accepting forwarded credentials
GSS-API acceptor services relying on gss_accept_sec_context() with Kerberos mechanism

Discovery Timeline

2026-10-08 - CVE-2026-107778 published to the National Vulnerability Database
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107778

Vulnerability Analysis

The vulnerability occurs in make_cred_list(), invoked from krb5_rd_cred() when decoding a KRB-CRED protocol message. The function iterates over the tickets array in the KRB-CRED structure and pairs each ticket with the corresponding entry in the encrypted ticket_info array. The code assumes both arrays have equal length. An attacker can craft a KRB-CRED where tickets is longer than ticket_info, causing the index to walk past the end of ticket_info and read a NULL terminator. The subsequent access to info->client dereferences a NULL pointer and crashes the process.

Any long-lived GSS-API acceptor, such as an SSH server, NFS daemon, HTTP service with SPNEGO, or application server using Kerberos delegation, aborts when it processes the malformed credential.

Root Cause

The root cause is missing bounds validation between two related arrays supplied in attacker-controlled protocol input. The loop in make_cred_list() dereferences encpart->ticket_info[i] without confirming that index i falls within the allocated ticket_info array, which is NULL-terminated rather than length-checked against the outer tickets array.

Attack Vector

Exploitation requires valid Kerberos credentials, so the attacker must first authenticate. The attacker then initiates a GSS-API context establishment with credential delegation and sends a crafted KRB-CRED containing mismatched array lengths. The acceptor process invokes krb5_rd_cred(), hits the NULL dereference inside make_cred_list(), and terminates. No memory corruption or code execution occurs; the impact is limited to availability.

// Patched code in src/lib/krb5/krb/rd_cred.c
            goto cleanup;

        info = encpart->ticket_info[i];
        if (info == NULL) {
            /* We unexpectedly reached the end of the encrypted ticket info. */
            ret = KRB5KRB_AP_ERR_MODIFIED;
            goto cleanup;
        }
        ret = krb5_copy_principal(context, info->client, &list[i]->client);
        if (ret)
            goto cleanup;

Source: krb5 commit 48afa9a. The patch adds an explicit NULL check and returns KRB5KRB_AP_ERR_MODIFIED when the encrypted ticket info array is exhausted before the ticket array.

Detection Methods for CVE-2026-107778

Indicators of Compromise

Unexpected crashes or segmentation faults in services linking libkrb5, such as sshd, nfsd, or Kerberized HTTP servers.
Core dumps whose stack trace includes make_cred_list and krb5_rd_cred frames.
Repeated GSS-API acceptor restarts correlated with authenticated Kerberos sessions from a single principal.

Detection Strategies

Monitor system logs for SIGSEGV events in Kerberos-enabled daemons and correlate with recent GSS-API context establishment attempts.
Enable Kerberos trace logging via KRB5_TRACE on acceptor hosts to capture malformed KRB-CRED messages before the crash.
Inspect network captures for KRB-CRED messages where the ticket array length does not match the encrypted ticket info count.

Monitoring Recommendations

Alert on crash loops of services registered as Kerberos acceptors and tie the alert to the authenticated principal from preceding audit records.
Track invocations of gss_accept_sec_context() returning major status GSS_S_DEFECTIVE_CREDENTIAL after the patch is deployed.
Forward Kerberos KDC and application server logs to a central platform for pattern analysis across hosts.

How to Mitigate CVE-2026-107778

Immediate Actions Required

Inventory all systems running krb5 builds at or below 1.22.2 and prioritize patching of exposed GSS-API acceptor services.
Apply the upstream fix from the MIT krb5 project or the backport provided by your Linux distribution.
Restrict Kerberos authentication to trusted principals where feasible until patches are deployed.

Patch Information

The fix is published in the MIT krb5 upstream repository through commit 48afa9a and commit 62196e2, and discussed in Pull Request #1511. Additional analysis is available in the VulnCheck advisory. Rebuild libkrb5 from a patched source tree or install the vendor update, then restart all services that link the library.

Workarounds

Disable Kerberos credential delegation on services that do not require forwarded tickets, which prevents the vulnerable code path from executing.
Enforce service restart policies and process supervisors so that a crashed acceptor restarts quickly, limiting the duration of denial of service.
Limit network reachability of Kerberos acceptor services to authenticated internal networks.

bash

# Example: disable GSSAPI credential delegation on OpenSSH servers
# in /etc/ssh/sshd_config
GSSAPIAuthentication yes
GSSAPIDelegateCredentials no
GSSAPICleanupCredentials yes

# Reload the service after editing
sudo systemctl reload sshd