High · CVSS 7.5CVE-2026-119079

Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decodingCVE-2026-119079

Answer in brief

CVE-2026-119079 records a High severity (CVSS 7.5) vulnerability in Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding. The current sources do not mark it as known exploited. The current feed maps Red Hat/krb5 (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Nov 9, 2026Updated Nov 9, 2026Source checked Nov 9, 2026First seen by HOL Nov 9, 2026Material review Nov 9, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.5
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/krb5 (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/krb5generic	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/krb5.
Review the reported fix. Source-reported workaround: Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld. 1. Add a rich rule permitting TCP port 88 only from trusted networks (substitute with the appropriate network CIDR): firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="88" protocol="tcp" accept' 2. Ensure unauthenticated or public access to port 88/tcp is removed: firewall-cmd --permanent --remove-port=88/tcp 3. Apply the changes: firewall-cmd --reload Warning: Applying firewall changes requires reloading firewalld, which may temporarily disrupt network traffic. Restricting TCP access will prevent clients outside the allowed network range from falling back to TCP for large Kerberos ticket exchanges.

Evidence timeline and material changes

Published upstream
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Nov 9, 2026

Sources and claim methodology

Upstream source description

decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

Quoted source text, attributed separately from HOL analysis.

Package

Affected range

Fixed version

Red Hat/krb5generic

Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/krb5.

Review the reported fix. Source-reported workaround: Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld. 1. Add a rich rule permitting TCP port 88 only from trusted networks (substitute with the appropriate network CIDR): firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="88" protocol="tcp" accept' 2. Ensure unauthenticated or public access to port 88/tcp is removed: firewall-cmd --permanent --remove-port=88/tcp 3. Apply the changes: firewall-cmd --reload Warning: Applying firewall changes requires reloading firewalld, which may temporarily disrupt network traffic. Restricting TCP access will prevent clients outside the allowed network range from falling back to TCP for large Kerberos ticket exchanges.

Sources and claim methodology

Upstream source description

Quoted source text, attributed separately from HOL analysis.