CVE Alert: CVE-2026-119079 – Red Hat

decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

**Risk verdict:** This is a high operational risk to exposed Kerberos authentication services; exploitation urgency cannot be confirmed because KEV, SSVC, PoC and EPSS data were not provided.

**Why this matters:** An attacker could consume KDC CPU without credentials, potentially degrading or interrupting authentication across dependent services. The likely goal is denial of service, disrupting logons and service-to-service authentication rather than stealing data or changing permissions.

**Most likely attack path:** A remote attacker sends crafted requests over TCP to a reachable KDC; low complexity, no privileges and no user action make the attack path straightforward. Impact is scoped to the affected service, so direct lateral movement is not indicated, though an outage could affect many systems that rely on it.

**Who is most exposed:** Prioritise centrally managed KDCs reachable from untrusted networks, including internet-facing, cloud and multi-site deployments. Hardened images and systems with uncertain support status also need inventory and package verification.

Alert on sustained KDC CPU increases alongside authentication latency or failures.

Inspect TCP port 88 traffic for unusually large or repeated Kerberos requests.

Correlate source addresses, request volume and KDC resource consumption.

Review service logs for malformed-request errors or bursts of AS/TGS requests.

Mitigation and prioritisation

Check vendor advisories and deploy the fixed package as soon as available; verify each affected estate.

Restrict TCP port 88 to trusted networks where operationally safe.

Test firewall changes: blocking TCP may disrupt clients relying on fallback for large exchanges.

Reassess priority when exploitation intelligence and EPSS become available; if KEV is true or EPSS is at least 0.5, treat as priority 1.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.