CVE-2026-40355

What it actually does

MIT Kerberos 5 before 1.22.3 can dereference a NULL pointer in the GSS-API acceptor path when an application calls gss_accept_sec_context() and a NegoEx mechanism is registered in /etc/gss/mech. A remote unauthenticated attacker can send a specially formed negotiation message that reaches parse_nego_message and causes the receiving process to terminate. The impact is denial of service against the vulnerable process; there is no indicated confidentiality or integrity compromise.

Why it matters to the business

Services that rely on MIT Kerberos/GSS-API authentication can be crashed remotely if they run a vulnerable krb5 version and have NegoEx enabled. This can interrupt authentication-dependent applications, cause repeated service restarts, and create operational instability for externally reachable or business-critical services. Current public exploitation signals are low: EPSS is 0.00611 with no 30-day increase, the issue is not in CISA KEV, and no mature public exploit is reported, but exposed high-availability authentication services should still be remediated because the outcome is service outage.

How an attack unfolds

An attacker first identifies a network service that uses MIT krb5 GSS-API acceptor functionality and is reachable without prior authentication. The vulnerable condition also requires the system to have a NegoEx mechanism registered in /etc/gss/mech. The attacker initiates a security-context negotiation and sends malformed or unexpected NegoEx-related data that is processed by gss_accept_sec_context(). In vulnerable krb5 versions, the message parsing path reaches parse_nego_message and dereferences a NULL pointer, causing the hosting process to crash. Repeating the request can sustain a denial-of-service condition, especially where service managers automatically restart the process.

How to fix it

Upgrade MIT Kerberos 5 to version 1.22.3 or later wherever GSS-API acceptor applications are present. If an immediate upgrade is not possible, review /etc/gss/mech and remove or disable the NegoEx mechanism if it is not required, then restart affected services so the mechanism configuration is reloaded. Reduce exposure by limiting network access to Kerberos/GSS-API-enabled services, applying rate limits where practical, and ensuring service managers have sane restart/backoff behavior to prevent crash loops. Rebuild or update statically linked applications and downstream packages that bundle vulnerable krb5 libraries.

How to confirm the fix worked

Confirm installed krb5 package/library versions report 1.22.3 or later. Check whether /etc/gss/mech contains a NegoEx mechanism registration and verify it has been removed or disabled where not needed. Restart affected services and confirm they are linked against the updated libgssapi_krb5 and libkrb5 libraries, not an older bundled copy. Review package manager output, service dependency metadata, and runtime library mappings such as ldd or equivalent tooling. For exposure validation, inventory network-facing services that use GSS-API acceptor functionality and verify compensating controls restrict untrusted access.

Typical attack path

1. Scan for or identify services that accept Kerberos/GSS-API security context negotiation over the network.
2. Confirm or infer that the target stack uses MIT Kerberos 5 before 1.22.3 and has NegoEx registered in /etc/gss/mech.
3. Open an unauthenticated connection to the affected service.
4. Send a crafted negotiation message that triggers the NegoEx parsing path during gss_accept_sec_context().
5. Cause the process to terminate through a NULL pointer dereference in parse_nego_message.
6. Repeat the request as needed to maintain service disruption or exhaust restart limits.

How to detect it

Look for evidence of service crashes rather than successful authentication events. Useful sources include system logs, kernel crash messages, service manager journals, application logs for Kerberos/GSS-API-enabled services, core dump indexes, endpoint telemetry, and network logs showing repeated unauthenticated connection attempts immediately before crashes. Prioritize events where processes linked to libgssapi_krb5 or libkrb5 terminate with SIGSEGV, segmentation fault, access violation, or core dump messages referencing parse_nego_message, gss_accept_sec_context, NegoEx, or mechglue. Correlate crash timestamps with remote source IPs making repeated negotiation attempts to the same service. Also inspect /etc/gss/mech to determine whether NegoEx was registered at the time of the crashes. Because no known threat actors or mature public exploit are reported, detection should focus on abnormal crash/restart patterns and repeated malformed negotiation attempts rather than actor-specific infrastructure.

• /etc/gss/mech
• NegoEx
• negoex
• parse_nego_message
• gss_accept_sec_context
• libgssapi_krb5
• libkrb5
• SIGSEGV
• segmentation fault
• Segmentation fault
• core dumped
• NULL pointer dereference
• mechglue

What your security team should do

• Prioritize upgrading MIT Kerberos 5 to 1.22.3 or later on systems running network-facing GSS-API/Kerberos-enabled services.
• Search configuration management and endpoint inventories for /etc/gss/mech entries that register NegoEx, and disable NegoEx where it is not operationally required.
• Identify applications that call GSS-API acceptor functions, especially externally reachable services, and confirm they use patched shared libraries or have been rebuilt if statically linked.
• Monitor for unexplained crashes, core dumps, and restart loops in Kerberos/GSS-API-enabled services, particularly after unauthenticated connection attempts.
• Add temporary network restrictions or rate limiting around affected services until patching is complete.
• Track vendor advisories for operating system and appliance packages that redistribute MIT krb5, because fixed package names and backported version strings may differ from upstream 1.22.3.