Kerberos Vulnerabilities Lead to Denial of Service Risks

Linuxsecurity

Kerberos Vulnerabilities Lead to Denial of Service Risks

First seen 23 Jul 2026, 01:23 UTC • •70.5

Article Content

1 / 5

Browse articles

ThreatCluster •July 24, 2026 at 01:16 UTC

•Kerberos has critical vulnerabilities that can lead to denial of service attacks.
•Affected CVEs include CVE-2026-11850, CVE-2026-40355, and CVE-2026-40356.
•Users must update their systems and restart Kerberos to apply necessary security fixes.

Multiple vulnerabilities were discovered in Kerberos, specifically an integer underflow in the berval2tl_data() function (CVE-2026-11850) and issues in the NegoEx mechanism parsing (CVE-2026-40355, CVE-2026-40356). These vulnerabilities could allow remote attackers to crash Kerberos, resulting in denial of service. The vulnerabilities affect various versions of the MIT Kerberos Network Authentication Protocol. Users are advised to update their systems to the latest package versions to mitigate these risks. Affected systems include Ubuntu 26.04 LTS and earlier versions. After applying updates, a restart of Kerberos is necessary to implement changes. The vulnerabilities were disclosed in July 2026, with prior CVE publications dating back to April and June 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 60d ago How this analysis works

Timeline

2026-04-28

CVE-2026-40355 and CVE-2026-40356 published

Two vulnerabilities in Kerberos were published, allowing potential denial of service attacks.

2026-06-11

CVE-2026-11850 published

An integer underflow vulnerability in Kerberos was disclosed, enabling denial of service.

2026-07-22

Kerberos vulnerabilities disclosed

Ubuntu released a security notice detailing multiple vulnerabilities in Kerberos affecting various versions.

2026-07-22

Patch released for Kerberos vulnerabilities

Ubuntu provided updates for affected Kerberos packages and advised users to restart the service post-update.

More articles in this cluster (4)

Threat Graph

8 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Denial of Service

Organization (1)

Ubuntu

Vulnerability (3)

CVE-2026-11850
CVE-2026-40355
CVE-2026-40356

Weakness (1)

Cwe-190 - Integer Overflow Or Wraparound

Affected Platform (2)

Linux
MIT Kerberos

Relationships

CVE-2026-11850 targets Linux
CVE-2026-11850 targets MIT Kerberos
CVE-2026-40355 targets Linux
CVE-2026-40355 targets MIT Kerberos
CVE-2026-40356 targets Linux
CVE-2026-40356 targets MIT Kerberos
Denial of Service targets Linux
Denial of Service targets MIT Kerberos
CVE-2026-11850 related to Ubuntu
CVE-2026-11850 related to Cwe-190 - Integer Overflow Or Wraparound

Following this threat?

Track Ubuntu and CVE-2026-11850 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…