MIT Kerberos 5: Denial of Service via SEQUENCE OF array growth (CVE-2026-119079)
A vulnerability in MIT Kerberos 5 (krb5) versions 1.11 and later allows remote, unauthenticated attackers to cause a denial of service on a Key Distribution Center (KDC) via excessive CPU consumption.
CVE search metadata
CVE search record: CVE-2026-119079. Severity: high. CVSS: 7.5. KEV: no. Product: Kerberos 5 (>= 1.11). Brief: MIT Kerberos 5: Denial of Service via SEQUENCE OF array growth (CVE-2026-119079). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mit-kerberos-dos/
Triage facts
Revision 1- Applicability
- Kerberos 5 (>= 1.11)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 21:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
The function decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c within MIT Kerberos 5 (krb5) versions 1.11 and later suffers from inefficient array growth management. A remote, unauthenticated attacker can exploit this by sending a specially crafted AS-REQ or TGS-REQ message containing a large number of elements within a SEQUENCE OF field over TCP. This triggers excessive CPU usage on the Key Distribution Center (KDC), resulting in a denial of service condition.
Impact
Successful exploitation results in KDC service unavailability due to CPU exhaustion, preventing legitimate authentication requests across the Kerberos domain.
Recommendation
- Identify all hosts running MIT Kerberos 5 (krb5) version 1.11 or later in the environment.
- Monitor for security updates from the MIT Kerberos consortium or operating system distribution vendors and apply patches as they become available.
- Until patched, restrict network access to the KDC (typically port 88 TCP) to known, trusted subnets to limit the attack surface for remote, unauthenticated exploitation.
Immediate actions
Inventory and patch systems running vulnerable MIT Kerberos 5 versions
Threat Hunt
Monitor for KDC process CPU spikes coincident with high rates of incoming TCP/88 traffic
Data: KDC process resource utilization, TCP connection metrics on port 88
Mitigations
Restrict KDC access (TCP/88) to trusted network segments
CVE-2026-119079