CVE-2026-71200: 
Kerberos vulnerability analysis and mitigation

CVE-2026-71200 is a NULL pointer dereference vulnerability in the MIT Kerberos 5 (krb5) KDC PKINIT authentication path that allows an unauthenticated remote attacker to crash the KDC process. The vulnerability affects krb5-1.21.3-8.el10_0 when built with PKINIT support and deployed with PKINIT enabled (pkinit_identity and pkinit_anchors configured). It was reported on 2026-05-18 and published on 2026-11-09, with a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and resides in cms_signeddata_verify() within src/plugins/preauth/pkinit/pkinit_crypto_openssl.c. When the KDC processes a crafted unauthenticated AS-REQ containing KRB5_PADATA_PK_AS_REQ, the code enters a no-signer branch where it calls CMS_get0_content(cms) and checks whether the returned octets pointer is non-NULL, but fails to verify that *octets (the pointee) is also non-NULL before dereferencing it via BIO_new_mem_buf((*octets)->data, (*octets)->length). An attacker can trigger this by sending a CMS SignedData message with empty signerInfos and an omitted encapContentInfo.eContent, causing CMS_get0_content() to return a non-NULL pointer whose pointee is NULL, resulting in a crash. The proposed fix adds a guard if (octets && *octets) before the BIO construction (Red Hat Bugzilla).

Successful exploitation causes the KDC process to terminate, resulting in a complete denial of Kerberos authentication service. All users and services relying on Kerberos for authentication in the affected environment would be unable to obtain tickets, effectively disrupting access to any Kerberos-dependent infrastructure. There is no confidentiality or integrity impact — the vulnerability is availability-only (Red Hat Bugzilla, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The attack requires only network reachability to a PKINIT-enabled KDC and no authentication, making it low-complexity once a vulnerable target is identified. The CVE status remains "Reserved" and no EPSS score or CISA KEV listing has been reported (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Identify KDC hosts on the target network (typically UDP/TCP port 88) and determine whether PKINIT is enabled by attempting a PKINIT AS-REQ and observing the response.
2. Craft malicious AS-REQ: Construct a Kerberos AS-REQ message containing a KRB5_PADATA_PK_AS_REQ pre-authentication element.
3. Prepare malformed CMS SignedData: Within the signedAuthPack field, embed a CMS SignedData structure with an empty signerInfos sequence and an omitted encapContentInfo.eContent field.
4. Send the request: Transmit the crafted AS-REQ to the KDC over the network (no credentials required).
5. Observe KDC crash: The KDC enters the no-signer branch in cms_signeddata_verify(), dereferences a NULL *octets pointer in BIO_new_mem_buf(), and terminates, denying authentication service to all users (Red Hat Bugzilla).

• Network: Unexpected or repeated unauthenticated AS-REQ packets (UDP/TCP port 88) containing KRB5_PADATA_PK_AS_REQ pre-authentication data from unknown or untrusted source IPs.
• Logs: KDC process crash entries or segmentation fault signals in system logs (e.g., /var/log/krb5kdc.log, journalctl -u krb5kdc); absence of KDC responses following such requests.
• Process: Unexpected termination of the krb5kdc process; repeated automatic restarts of the KDC service by the init system (systemd restart logs).

Apply the vendor-provided security patch as soon as it becomes available for your distribution (tracked in Red Hat Bugzilla #2478447 and Slackware advisory). As an immediate workaround, disable PKINIT on the KDC by removing or commenting out pkinit_identity and pkinit_anchors from the KDC configuration if PKINIT is not operationally required. Where PKINIT must remain enabled, restrict KDC network access to trusted hosts and networks using firewall rules to reduce exposure until a patch is applied (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was acknowledged by Red Hat's Product Security team and assigned a "Moderate" severity rating, noting that exploitation depends on the optional PKINIT configuration rather than a default install. The issue was credited to Aisle Research. A Slackware security advisory was also issued for the krb5 package, and the fix was tracked in FreeBSD ports (Red Hat Bugzilla, Linux Security).