CVE-2024-37370 In MIT Kerberos 5 (aka krb5) before 1.21.3 an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token causing the unwrapped token to appear truncated to the application.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in MIT Kerberos 5 Identified and Published Two vulnerabilities in MIT Kerberos 5 (krb5) before version 1.21.3 have been identified. CVE-2024-37370 allows an attacker to modify the Extra Count field of a GSS krb5 wrap token, while CVE-2024-37371 enables invalid memory reads during GSS message token handling. Both vulnerabilities were published on June 28, 2024. 2 sources 34

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (1)