This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-119079 →
Unrated
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time,...
DEBIAN-CVE-2026-119079
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Debian:12krb5 |
All versions→ Not listed |
Not listed |
| Debian:13krb5 |
All versions→ Not listed |
Not listed |
| Debian:14krb5 |
All versions→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- advisory security-tracker.debian.org