Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Azure krb5 can crash from malformed cross-realm request
published 27 days ago
Summary
The Azure krb5 package (version 1.21.3-5) may stop working if it receives a specially crafted request from a trusted cross‑realm server that contains an invalid client name. This can cause the authentication service to crash, preventing users from logging in. Update the krb5 package to a version that fixes the issue or apply the vendor’s recommended patch.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | krb5 | <= 1.21.3-5 |
Original advisory text
CVE-2026-107708 affecting package krb5 1.21.3-5
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
References
Timeline
Published8 Oct 2026
Updated9 Oct 2026
First seen9 Oct 2026
Sources
AZL-106836 · OSV
Track software like this
Free during beta