{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kerberos-5--1.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-119079"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kerberos 5 (\u003e= 1.11)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MIT"],"content_html":"\u003cp\u003eThe function decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c within MIT Kerberos 5 (krb5) versions 1.11 and later suffers from inefficient array growth management. A remote, unauthenticated attacker can exploit this by sending a specially crafted AS-REQ or TGS-REQ message containing a large number of elements within a SEQUENCE OF field over TCP. This triggers excessive CPU usage on the Key Distribution Center (KDC), resulting in a denial of service condition.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in KDC service unavailability due to CPU exhaustion, preventing legitimate authentication requests across the Kerberos domain.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all hosts running MIT Kerberos 5 (krb5) version 1.11 or later in the environment.\u003c/li\u003e\n\u003cli\u003eMonitor for security updates from the MIT Kerberos consortium or operating system distribution vendors and apply patches as they become available.\u003c/li\u003e\n\u003cli\u003eUntil patched, restrict network access to the KDC (typically port 88 TCP) to known, trusted subnets to limit the attack surface for remote, unauthenticated exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T21:57:46Z","date_published":"2026-11-09T21:57:46Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mit-kerberos-dos/","summary":"A vulnerability in MIT Kerberos 5 (krb5) versions 1.11 and later allows remote, unauthenticated attackers to cause a denial of service on a Key Distribution Center (KDC) via excessive CPU consumption.","title":"MIT Kerberos 5: Denial of Service via SEQUENCE OF array growth (CVE-2026-119079)","url":"https://feed.craftedsignal.io/briefs/2026-11-mit-kerberos-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Kerberos 5 (\u003e= 1.11)","version":"https://jsonfeed.org/version/1.1"}