CVE-2026-40355 Null dereference in Kerberos 5

What is CVE-2026-40355?

CVE-2026-40355 is a medium-severity vulnerability in Mit Kerberos 5, published on 28 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

Weakness: CWE-476

Which versions are affected by CVE-2026-40355?

It affects 1 product.

Products include Mit Kerberos 5.

How do I fix CVE-2026-40355?

Upgrade to a fixed version.

Is CVE-2026-40355 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40355 exists.

Other vulnerabilities in Mit Kerberos 5

• CVE-2011-0285 Use after free in n/a Critical 10.0
• CVE-2008-0947 Memory corruption in n/a Critical 10.0
• CVE-2007-5902 Integer overflow in n/a Critical 10.0
• CVE-2007-4743 Memory corruption in n/a Critical 10.0
• CVE-2007-3999 Memory corruption in n/a Critical 10.0

All Mit Kerberos 5 vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-85235, BELL-CVE-2026-40355, DEBIAN-CVE-2026-40355, ECHO-3921-9f59-f2e1, GHSA-8qgv-wm66-hrmc, JLSEC-2026-1258 and 1 more.