CVE 2026 119079

decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

This vulnerability is evaluated as an Important severity issue because remote unauthenticated attackers can cause excessive CPU consumption and degrade KDC availability without requiring valid credentials or user interaction. In Red Hat Enterprise Linux environments, this impact specifically targets the krb5kdc daemon when listening for incoming TCP traffic from untrusted networks. Systems where the Kerberos Key Distribution Center is restricted to trusted subnets experience lower operational risk, and the flaw cannot be leveraged for unauthorized data disclosure or remote code execution.

Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld.

1. Add a rich rule permitting TCP port 88 only from trusted networks (substitute with the appropriate network CIDR): firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="88" protocol="tcp" accept'

2. Ensure unauthenticated or public access to port 88/tcp is removed: firewall-cmd --permanent --remove-port=88/tcp

3. Apply the changes: firewall-cmd --reload

Warning: Applying firewall changes requires reloading firewalld, which may temporarily disrupt network traffic. Restricting TCP access will prevent clients outside the allowed network range from falling back to TCP for large Kerberos ticket exchanges.

Bugzilla 2479231 : krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding

CWE-408 : Incorrect Behavior Order: Early Amplification

Common Vulnerability Scoring System (CVSS) Score Details

Info alert: Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications ).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Understanding the Weakness (CWE)

Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)

System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.

This issue was discovered by AISLE Research and Found by AISLE in partnership with Red Hat.

Frequently Asked Questions

"Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.

The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.

Upgrade to a supported product version that includes a fix for this vulnerability (recommended).

Apply a mitigation (if one exists).

Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Apply a mitigation (if one exists).

Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.

Customers with the technical account manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Not sure what something means? Check out our Security Glossary .

For clarification or corrections, please Red Hat Product Security .