https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T03:05:54.989792+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-112318 CVE-2026-112318 — Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers 2026-11-13T03:05:54.990791+00:00

Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.2 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.8 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Hardened Images

The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.