Memory Exhaustion in MIT Kerberos KDC via AS-REQ

Executive Summary

CVE-2026-119079 is a denial-of-service vulnerability in MIT Kerberos 5 (krb5) versions 1.11 and later. It occurs in the decode_sequence_of() function where the decoded element array grows one entry at a time during processing of SEQUENCE OF fields in AS-REQ or TGS-REQ requests. This allows remote unauthenticated attackers to cause excessive CPU consumption in the Key Distribution Center (KDC) by sending crafted requests with a large number of elements over TCP.

Useful 0 Not Useful 0

Detection Guidance

Monitor KDC CPU usage spikes during Kerberos authentication attempts. Check for repeated large AS-REQ or TGS-REQ messages over TCP port 88. Use network traffic analyzers like tcpdump to capture suspicious payloads with excessive elements in SEQUENCE OF fields.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing CPU exhaustion in the KDC, leading to degraded service availability. An attacker can send maliciously crafted requests to consume significant CPU resources, potentially making the Kerberos authentication service unresponsive. The attack does not require credentials or user interaction and is exploitable over TCP if the KDC is reachable.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict TCP port 88 access to trusted networks using firewalld. Add rules to allow only authorized IPs and reload firewalld. Disable unauthenticated access to port 88/tcp if possible. Consider rate limiting Kerberos requests.

Useful 0 Not Useful 0