CVE-2026-40356

What it actually does

MIT Kerberos 5 before 1.22.3 contains an integer underflow in the NegoEx message parsing path reached when an application calls gss_accept_sec_context() and a NegoEx mechanism is registered in /etc/gss/mech. A remote unauthenticated peer can send a crafted authentication negotiation message that causes an out-of-bounds read and may terminate the accepting process in parse_message. The primary impact is denial of service against Kerberos/GSS-API-enabled services that accept network authentication; confidentiality and integrity impact are not indicated by the published details.

Why it matters to the business

An attacker may be able to crash exposed services that rely on MIT Kerberos/GSS-API authentication, causing outages or authentication failures for dependent applications. The risk is moderated by high attack complexity, low and stable EPSS, no known CISA KEV listing, and no reported exploit maturity, but organizations using NegoEx with krb5 should still prioritize patching because successful exploitation can disrupt critical login, SSO, file, database, or application access paths.

How an attack unfolds

An attacker first identifies a network service that uses MIT Kerberos/GSS-API to accept authentication contexts. The vulnerable condition requires the server-side system to have a NegoEx mechanism registered in /etc/gss/mech and to run a krb5 version earlier than 1.22.3. The attacker then initiates an unauthenticated security context negotiation and sends a malformed NegoEx-related message. When the target application calls gss_accept_sec_context(), krb5 parses the crafted message, triggers an integer underflow, performs an out-of-bounds read, and may crash the process in parse_message. The result is service disruption rather than credential theft or code execution based on currently available information.

How to fix it

Upgrade MIT Kerberos 5 to version 1.22.3 or a vendor-supported package version that backports the fix. Prioritize systems running network-facing or business-critical services that use GSS-API/Kerberos authentication and have NegoEx configured. If immediate patching is not possible, reduce exposure by disabling unnecessary NegoEx mechanism registration in /etc/gss/mech where operationally safe, restricting network access to affected services, placing authentication endpoints behind trusted network controls, and ensuring process supervisors apply rate limiting or backoff to repeated crashes. Validate compatibility before removing or changing GSS mechanisms in production because authentication behavior may change.

How to confirm the fix worked

Confirm installed MIT krb5 libraries and packages report version 1.22.3 or a vendor advisory version containing the backported fix. Check whether /etc/gss/mech contains a NegoEx mechanism registration to determine whether the vulnerable code path is likely reachable. Inventory services linked against libgssapi_krb5 or otherwise using gss_accept_sec_context() and confirm they have been restarted after patching so the fixed library is loaded. Review service health after upgrade and, where safe, run controlled GSS-API authentication tests to confirm normal negotiation succeeds without crashes. For exposure validation, combine package version checks, configuration review, and network service inventory rather than relying only on vulnerability scanner banners.

Typical attack path

1. Find externally or internally reachable services that accept GSS-API/Kerberos authentication.
2. Confirm or infer that the target uses MIT krb5 before 1.22.3 and has NegoEx registered in /etc/gss/mech.
3. Open a connection to the target service and begin a GSS-API/SPNEGO-style authentication negotiation.
4. Send a crafted NegoEx message that triggers the vulnerable parser path during gss_accept_sec_context().
5. Cause the accepting service process to terminate or restart, producing a denial-of-service condition.
6. Repeat the request to sustain disruption if the service supervisor automatically restarts the process.

How to detect it

To determine whether exploitation may have already occurred, review application, system, and crash logs on services that use MIT krb5/GSS-API authentication. Focus on unexplained process terminations, segmentation faults, aborts, core dumps, watchdog restarts, or service-manager restart loops occurring during authentication attempts. Useful sources include systemd journal, syslog, application-specific authentication logs, crash dump services such as systemd-coredump or ABRT, endpoint telemetry, and network captures or IDS metadata for SPNEGO/NegoEx negotiation. In crash artifacts, look for stack frames or symbols such as parse_message and gss_accept_sec_context. In configuration and exposure reviews, look for NegoEx registration in /etc/gss/mech. Network evidence alone is unlikely to be definitive unless it captures malformed NegoEx messages; correlate suspicious negotiation attempts with immediate service crashes or restarts. No public threat actor exploitation or ransomware use is indicated by the provided data, so prioritize anomaly-based detection and crash forensics over actor-specific indicators.

• /etc/gss/mech
• NegoEx
• parse_message
• gss_accept_sec_context
• 1.3.6.1.4.1.311.2.2.30
• systemd-coredump
• Segmentation fault
• core dumped
• Main process exited, code=dumped
• Scheduled restart job
• libgssapi_krb5
• libkrb5

What your security team should do

• Patch MIT krb5 to 1.22.3 or the relevant vendor-fixed build on systems providing Kerberos/GSS-API-authenticated network services.
• Identify systems with NegoEx entries in /etc/gss/mech and prioritize them because the vulnerable condition depends on NegoEx registration.
• Prioritize internet-facing, partner-facing, and business-critical authentication endpoints even though EPSS is currently low and the CVE is not listed in CISA KEV.
• Restart affected services after updating krb5 libraries to ensure patched code is in use.
• If patching is delayed, restrict access to affected services and remove unnecessary NegoEx registration where application compatibility permits.
• Monitor for unexplained crashes, core dumps, or repeated restarts of Kerberos/GSS-API-enabled services, especially involving parse_message or gss_accept_sec_context stack traces.
• Add detection content for malformed or unusual SPNEGO/NegoEx authentication negotiation attempts where network telemetry supports protocol inspection.