CVE-2023-25566 GSS-NTLMSSP vulnerable to memory leak when parsing usernames

High 7.5 Published 14 Feb 2023 Updated 10 Mar 2025

An attacker can cause a denial of service by triggering a memory leak during username parsing in the GSS-NTLMSSP library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-25566?

CVE-2023-25566 is a high-severity denial of service vulnerability in gssapi gss-ntlmssp, published on 14 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-service. The domain portion of a username may be overridden causing an allocated memory area the size of the domain name to be leaked. An attacker can leak memory via the main `gss_accept_sec_context` entry point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0.

Weakness: CWE-401

Which versions are affected by CVE-2023-25566?

It affects 1 product.

Products include Gss-Ntlmssp Project Gss-Ntlmssp.

How do I fix CVE-2023-25566?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-25566 being exploited?

There is no known exploitation of CVE-2023-25566 in the wild and no public exploit code.

Sources

Also known as AZL-43471, AZL-44997, DEBIAN-CVE-2023-25566, GHSA-mfm4-6g58-jw74.