CVE-2026-119079
Description
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
Statement
This vulnerability is evaluated as an Important severity issue because remote unauthenticated attackers can cause excessive CPU consumption and degrade KDC availability without requiring valid credentials or user interaction. In Red Hat Enterprise Linux environments, this impact specifically targets the krb5kdc daemon when listening for incoming TCP traffic from untrusted networks. Systems where the Kerberos Key Distribution Center is restricted to trusted subnets experience lower operational risk, and the flaw cannot be leveraged for unauthorized data disclosure or remote code execution.
Mitigation
Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld.
1. Add a rich rule permitting TCP port 88 only from trusted networks (substitute with the appropriate network CIDR):
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="88" protocol="tcp" accept'
2. Ensure unauthenticated or public access to port 88/tcp is removed:
firewall-cmd --permanent --remove-port=88/tcp
3. Apply the changes:
firewall-cmd --reload
Warning: Applying firewall changes requires reloading firewalld, which may temporarily disrupt network traffic. Restricting TCP access will prevent clients outside the allowed network range from falling back to TCP for large Kerberos ticket exchanges.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Acknowledgements
This issue was discovered by AISLE Research and Found by AISLE in partnership with Red Hat.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
