CVE-2026-119079

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions 1.11 and later

Description Remote unauthenticated attackers can cause a denial of service resulting in CPU exhaustion in the Key Distribution Center (KDC) by sending an AS-REQ or TGS-REQ containing a large number of elements in a SEQUENCE OF field over TCP. This occurs because the decode sequence of() function in lib/krb5/asn.1/asn1 encode.c grows the decoded element array one entry at a time, leading to quadratic ASN.1 decoding (a process where the time to decode increases quadratically relative to the input size).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.