CVE-2026-40356: 
Kerberos vulnerability analysis and mitigation

CVE-2026-40356 is an integer underflow and out-of-bounds read vulnerability in MIT Kerberos 5 (krb5) affecting versions 1.18 through before 1.22.3. The flaw exists in the NegoEx message parsing code (parse_message() in negoex_util.c) and can be triggered when an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. It was reported by Cem Onat Karagun, disclosed on April 28, 2026, and carries a CVSS v3.1 base score of 5.9 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is an integer underflow (CWE-191) in the parse_message() function within src/lib/gssapi/spnego/negoex_util.c. When processing a NegoEx token, the code failed to verify that header_len is at least as large as the number of bytes already consumed before computing the remaining message length — allowing an integer underflow that results in an out-of-bounds read of up to 52 bytes. The fix adds the check header_len < (size_t)(in->ptr - msg_base) before the subtraction, returning GSS_S_DEFECTIVE_TOKEN on failure. A companion issue (CVE-2026-40355) in parse_nego_message() involves a null pointer dereference from an unchecked vector_base() return; both were addressed in the same commit (krb5 Commit, Red Hat Bugzilla). Exploitation requires no authentication and no user interaction, but does require that the target system has a NegoEx mechanism registered in /etc/gss/mech, which is a non-default configuration (krb5 Commit).

Successful exploitation causes the affected process to terminate in parse_message(), resulting in a denial of service. The out-of-bounds read covers up to 52 bytes, but exfiltration of those bytes does not appear possible, so confidentiality and integrity impacts are assessed as none. The primary risk is availability loss for any service relying on gss_accept_sec_context() with NegoEx enabled, which could include Kerberos-authenticated services such as SSH, LDAP, or web services on affected systems (krb5 Commit, GitHub Advisory).

1. Reconnaissance: Identify target systems running MIT krb5 versions 1.18–1.22.2 that expose Kerberos-authenticated network services (e.g., SSH with GSSAPI, LDAP, or HTTP with Negotiate auth) and have a NegoEx mechanism registered in /etc/gss/mech.
2. Craft malicious NegoEx token: Construct a SPNEGO/NegoEx authentication token where the header_len field in the NegoEx message header is set to a value smaller than the number of bytes already consumed during parsing, triggering the integer underflow condition in parse_message().
3. Send token to target: Initiate a GSSAPI authentication handshake with the target service and supply the malformed NegoEx token as the security context input to gss_accept_sec_context().
4. Trigger crash: The integer underflow causes an out-of-bounds read of up to 52 bytes in parse_message(), which may cause the process to terminate, resulting in denial of service for the targeted service (krb5 Commit, Red Hat Bugzilla).

• Logs: Unexpected process crashes or segmentation faults in services using GSSAPI (e.g., sshd, httpd, slapd) logged in /var/log/messages, /var/log/auth.log, or application-specific logs; error messages referencing ERR_NEGOEX_INVALID_MESSAGE_SIZE or GSS_S_DEFECTIVE_TOKEN.
• Network: Unusual or malformed SPNEGO/NegoEx authentication tokens in network traffic on Kerberos-related ports (TCP/UDP 88, 389, 636, 22, 80, 443); repeated failed GSSAPI authentication attempts from a single source IP.
• Process: Repeated crashes or restarts of GSSAPI-enabled services; core dump files generated by sshd, httpd, or other Kerberos-integrated daemons in /var/crash/ or /tmp/.

Upgrade MIT Kerberos 5 to version 1.22.3 or later, which contains the fix in commit 2e75f0d (krb5 Commit). Red Hat has issued patches for RHEL 8 (RHSA-2026:16799), RHEL 9 (RHSA-2026:19357), RHEL 10 (RHSA-2026:19145), and extended support variants (Red Hat Bugzilla). As a workaround, administrators can remove or disable any NegoEx mechanism entries from /etc/gss/mech if not required, which eliminates the vulnerable code path. Fedora, openSUSE, Debian, Amazon Linux 2023, and AlmaLinux have also released updated packages (Red Hat Bugzilla).

The vulnerability was reported by security researcher Cem Onat Karagun, who published a technical write-up at cems.fun covering both CVE-2026-40355 and CVE-2026-40356 (GitHub Advisory). Red Hat, IBM, openSUSE, Fedora, Debian, and Amazon Linux all issued advisories and patches within weeks of disclosure, indicating broad vendor response. Community discussion was noted on oss-security mailing lists and social platforms such as Bluesky, though overall attention was moderate given the medium severity and limited attack surface.