Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CentOS Kerberos packages may crash or expose data
published 14 days ago
Summary
The Kerberos components included in CentOS (krb5-devel, krb5-libs, krb5-pkinit, krb5-server, and krb5-server-ldap) contain bugs that can cause the software to stop working or read memory it shouldn't. This could lead to service interruptions or accidental disclosure of information. Apply the latest updates from the CentOS repositories as soon as they are available to fix the issues.
What to do
- Update centos krb5-devel to version 1.18.2-14.el8.tuxcare.els7.
- Update centos krb5-libs to version 1.18.2-14.el8.tuxcare.els7.
- Update centos krb5-pkinit to version 1.18.2-14.el8.tuxcare.els7.
- Update centos krb5-server to version 1.18.2-14.el8.tuxcare.els7.
- Update centos krb5-server-ldap to version 1.18.2-14.el8.tuxcare.els7.
- Update centos krb5-workstation to version 1.18.2-14.el8.tuxcare.els7.
- Update centos libkadm5 to version 1.18.2-14.el8.tuxcare.els7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:8.4 | centos | krb5-devel |
< 1.18.2-14.el8.tuxcare.els7 Fix: upgrade to 1.18.2-14.el8.tuxcare.els7
|
| TuxCare:CentOS:8.4 | centos | krb5-libs |
< 1.18.2-14.el8.tuxcare.els7 Fix: upgrade to 1.18.2-14.el8.tuxcare.els7
|
| TuxCare:CentOS:8.4 | centos | krb5-pkinit |
< 1.18.2-14.el8.tuxcare.els7 Fix: upgrade to 1.18.2-14.el8.tuxcare.els7
|
| TuxCare:CentOS:8.4 | centos | krb5-server |
< 1.18.2-14.el8.tuxcare.els7 Fix: upgrade to 1.18.2-14.el8.tuxcare.els7
|
| TuxCare:CentOS:8.4 | centos | krb5-server-ldap |
< 1.18.2-14.el8.tuxcare.els7 Fix: upgrade to 1.18.2-14.el8.tuxcare.els7
|
| TuxCare:CentOS:8.4 | centos | krb5-workstation |
< 1.18.2-14.el8.tuxcare.els7 Fix: upgrade to 1.18.2-14.el8.tuxcare.els7
|
| TuxCare:CentOS:8.4 | centos | libkadm5 |
< 1.18.2-14.el8.tuxcare.els7 Fix: upgrade to 1.18.2-14.el8.tuxcare.els7
|
Original advisory text
krb5: Fix of 2 CVEs
- CVE-2026-40355: NULL pointer dereference in parse_nego_message()
- CVE-2026-40356: integer underflow and out-of-bounds read in parse_message()
- CVE-2026-40356: integer underflow and out-of-bounds read in parse_message()
References
- https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1792592896.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-40355 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-40356 Vendor Advisory
Timeline
Published21 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1792592896 · OSV
Track software like this
Free during beta