Fix CVE-2026-40355 and CVE-2026-40356 in krb5

[Douglas R. Reno]

From oss-security:

Hi,

just a quick note that MIT krb5 has fixed two unauthenticated network
NegoEx parsing vulnerabilities.

Affected versions:

MIT krb5 1.18 and later, when an application calls
gss_accept_sec_context() on a system with a NegoEx mechanism registered
in /etc/gss/mech

Description:

CVE-2026-40355 is a null pointer dereference in parse_nego_message().
The result of the second vector_base() call was not checked before being
dereferenced. An unauthenticated remote attacker can trigger this issue
and crash the process.

CVE-2026-40356 is a read overrun of up to 52 bytes in parse_message().
A short header_len could cause an integer underflow while calculating the
remaining message length. An unauthenticated remote attacker can trigger
this issue and possibly crash the proces.
Exfiltration of the bytes read appears unlikely.

MIT krb5 security confirmed the following CVSS v3.1 vectors:

CVE-2026-40355:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base score: 7.5

CVE-2026-40356:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Base score: 5.9

Users are recommended to apply the upstream patch or update to a version
containing the fix.

Credit:
Cem Onat Karagun

References:
https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f
https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html
https://www.youtube.com/watch?v=zpBrriAJxCQ

[Joe Locash]

Fixed at c1642c81e3. Leaving open for SA.

[Douglas R. Reno]

SA-13.0-081 issued