Cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amitkerberos_5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 21:57:46 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMIT Kerberos 5: Denial of Service via SEQUENCE OF array growth (CVE-2026-119079)https://feed.craftedsignal.io/briefs/2026-11-mit-kerberos-dos/Mon, 09 Nov 2026 21:57:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mit-kerberos-dos/A vulnerability in MIT Kerberos 5 (krb5) versions 1.11 and later allows remote, unauthenticated attackers to cause a denial of service on a Key Distribution Center (KDC) via excessive CPU consumption.The function decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c within MIT Kerberos 5 (krb5) versions 1.11 and later suffers from inefficient array growth management. A remote, unauthenticated attacker can exploit this by sending a specially crafted AS-REQ or TGS-REQ message containing a large number of elements within a SEQUENCE OF field over TCP. This triggers excessive CPU usage on the Key Distribution Center (KDC), resulting in a denial of service condition.

Impact

Successful exploitation results in KDC service unavailability due to CPU exhaustion, preventing legitimate authentication requests across the Kerberos domain.

Recommendation

  • Identify all hosts running MIT Kerberos 5 (krb5) version 1.11 or later in the environment.
  • Monitor for security updates from the MIT Kerberos consortium or operating system distribution vendors and apply patches as they become available.
  • Until patched, restrict network access to the KDC (typically port 88 TCP) to known, trusted subnets to limit the attack surface for remote, unauthenticated exploitation.
]]>lowadvisory