Back Linuxsecurity

Fedora 42 Munge 0.5.18 Critical Buffer Overflow Vuln 2026

Linuxsecurity •LinuxSecurity Advisories • February 26, 2026

MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods. Update Information : update to 0.5.18, resolve CVE-2026-25506

MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating

and validating credentials. It is designed to be highly scalable for use

in an HPC cluster environment.

It allows a process to authenticate the UID and GID of another local or

remote process within a group of hosts having common users and groups.

These hosts form a security realm that is defined by a shared cryptographic

key. Clients within this security realm can create and validate credentials

without the use of root privileges, reserved ports, or platform-specific

update to 0.5.18, resolve CVE-2026-25506

* Fri Feb 13 2026 Michal Schmidt - 0.5.18-1 - Update to 0.5.18 * Fri Jan 16 2026 Fedora Release Engineering - 0.5.16-7 - Rebuilt for * Thu Jul 24 2025 Fedora Release Engineering - 0.5.16-6 - Rebuilt for

[ 1 ] Bug #2414773 - munge-0.5.18 is available [ 2 ] Bug #2438832 - CVE-2026-25506 munge: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery [fedora-42]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-ebf9437c9e' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Buffer Overflow in MUNGE Affects Fedora 42 and 43 A critical buffer overflow vulnerability has been identified in MUNGE version 0.5.18, affecting Fedora 42 and 43. This vulnerability allows unauthorized processes to authenticate as legitimate users within a shared security realm, potentially compromising system integrity. Users are advised to update their systems to mitigate this risk. 2 sources 45

Extracted Entities

CVEs (1)

CVE-2026-25506