MIT
MIT Kerberos: vulnerabilities and CVEs
MIT Kerberos has 35 published vulnerabilities, 1 of them in the last 12 months. 0 are rated critical and 0 are listed by CISA as actively exploited.
CVEs35
Last 12 months1
Critical0
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-11561 | High (8.8) | 0.80% | — | Oct 9, 2025 | A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin)… |
| CVE-2025-3576 | Medium (5.9) | 0.34% | — | Apr 15, 2025 | A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an… |
| CVE-2018-20217 | Medium (5.3) | 1.4% | — | Dec 26, 2018 | A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can… |
| CVE-2018-5710 | Medium (6.5) | 1.8% | — | Jan 16, 2018 | An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key… |
| CVE-2018-5709 | High (7.5) | 2.0% | — | Jan 16, 2018 | An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable… |
| CVE-2017-11368 | Medium (6.5) | 2.4% | — | Aug 9, 2017 | In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. |
| CVE-2014-5354 | Low (3.5) | 1.7% | — | Dec 16, 2014 | plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer… |
| CVE-2014-4342 | Medium (5) | 6.5% | — | Jul 20, 2014 | MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a… |
| CVE-2013-6800 | Medium (4) | 2.6% | — | Nov 18, 2013 | An unspecified third-party database module for the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon… |
| CVE-2011-0282 | Medium (5) | 3.5% | — | Feb 10, 2011 | The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (NULL pointer dereference or buffer over-read, and… |
| CVE-2011-0281 | Medium (5) | 4.2% | — | Feb 10, 2011 | The unparse implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (file descriptor… |
| CVE-2010-1323 | Low (3.7) | 2.8% | — | Dec 2, 2010 | MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text,… |
| CVE-2010-0283 | High (7.8) | 2.4% | — | Feb 22, 2010 | The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2, and 1.8 alpha, allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid (1) AS-REQ or (2)… |
| CVE-2009-4212 | High (10) | 7.6% | — | Jan 13, 2010 | Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of… |
| CVE-2009-0847 | Medium (4.3) | 2.8% | — | Apr 9, 2009 | The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers… |
| CVE-2009-0844 | Medium (5.8) | 4.3% | — | Apr 9, 2009 | The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via… |
| CVE-2009-0845 | Medium (5) | 5.6% | — | Mar 27, 2009 | The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer… |
| CVE-2004-0523 | High (10) | 12% | — | Aug 18, 2004 | Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root. |
| CVE-2003-0072 | Medium (5) | 1.9% | — | Apr 2, 2003 | The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that… |
| CVE-2003-0082 | Medium (5) | 2.7% | — | Apr 2, 2003 | The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that… |
| CVE-2003-0139 | High (7.5) | 4.3% | — | Mar 24, 2003 | Certain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for… |
| CVE-2003-0138 | High (7.5) | 4.3% | — | Mar 24, 2003 | Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack. |
| CVE-2001-0554 | High (10) | 39% | — | Aug 14, 2001 | Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by… |
| CVE-2001-0417 | Low (2.1) | 0.41% | — | Jun 27, 2001 | Kerberos 4 (aka krb4) allows local users to overwrite arbitrary files via a symlink attack on new ticket files. |
| CVE-2000-0548 | Medium (5) | 2.9% | — | Jun 9, 2000 | Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the e_msg variable in the kerb_err_reply function. |
| CVE-2000-0546 | Medium (5) | 2.9% | — | Jun 9, 2000 | Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the lastrealm variable in the set_tgtkey function. |
| CVE-2000-0550 | Medium (5) | 2.4% | — | Jun 9, 2000 | Kerberos 4 KDC program improperly frees memory twice (aka "double-free"), which allows remote attackers to cause a denial of service. |
| CVE-2000-0547 | Medium (5) | 2.9% | — | Jun 9, 2000 | Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the localrealm variable in the process_v4 function. |
| CVE-2000-0549 | Medium (5) | 2.3% | — | Jun 9, 2000 | Kerberos 4 KDC program does not properly check for null termination of AUTH_MSG_KDC_REQUEST requests, which allows remote attackers to cause a denial of service via a malformed request. |
| CVE-2000-0392 | High (7.2) | 0.44% | — | May 16, 2000 | Buffer overflow in ksu in Kerberos 5 allows local users to gain root privileges. |