CVE-2024-26462

Published: 29 February 2024

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

Notes

per upstream: "The ndr.c leak also affects an encoding function,
and triggers if the input contains invalid UTF-8.  This one
might be triggerable by a request (though it may require
elevated privilege), but I would not have requested a CVE for
it myself."

Status

References

• https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_3.md
• https://www.cve.org/CVERecord?id=CVE-2024-26462
• https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html
• NVD
• Launchpad
• Debian