Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-91926 →

UBUNTU-CVE-2026-91926

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV