PT-2024-2535 · Unknown+10 · Kerberos 5+10

Lumingyin · Published 2024-02-26 · Updated 2026-05-27 · CVE-2024-26461

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Kerberos 5 (aka krb5) version 1.21.2

Description The issue is related to a memory leak in the /krb5/src/lib/gssapi/krb5/k5sealv3.c component of the Kerberos 5 implementation. This memory leak vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For Kerberos 5 (aka krb5) version 1.21.2, consider restricting access to the vulnerable component /krb5/src/lib/gssapi/krb5/k5sealv3.c to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Allocation of Resources Without Limits

Memory Leak

Weakness Enumeration

CWE-770

CWE-401

Related Identifiers

ALSA-2024:3268

ALSA-2024:9331

AZL-35454

AZL-35481

BDU:2024-02520

CESA-2024_3268

CVE-2024-26461

ECHO-B3DC-369A-A35E

INFSA-2024_3268

INFSA-2024_9331

MGASA-2024-0158

OPENSUSE-SU-2024:13921-1

RHSA-2024:3268

RHSA-2024:9331

RHSA-2024_3268

RHSA-2024_9331

RLSA-2024:3268

SUSE-SU-2024:0997-1

SUSE-SU-2024:0999-1

SUSE-SU-2024:1001-1

SUSE-SU-2024:1006-1

SUSE-SU-2024:1148-1

SUSE-SU-2025:20051-1

USN-7314-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Kerberos 5

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 74

• 🔥 https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md · Exploit
• https://errata.almalinux.org/9/ALSA-2024-9331.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:9331 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1006-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-3268.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26461 · Security Note
• https://errata.almalinux.org/8/ALSA-2024-3268.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:3268 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0999-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-9331.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35454 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02520 · Security Note
• https://ubuntu.com/security/CVE-2025-24528 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory