CVE-2026-91926 Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair entries in ntlm challenge
A malicious server can cause client memory exhaustion and denial of service during NTLM authentication by sending duplicated AV_PAIR entries in a challenge message.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91926?
CVE-2026-91926 is a low-severity denial of service vulnerability in Red Hat Enterprise Linux 8, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.
Weakness: CWE-401
Which versions are affected by CVE-2026-91926?
How do I fix CVE-2026-91926?
No fix has been published for CVE-2026-91926 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-91926 being exploited?
There is no known exploitation of CVE-2026-91926 in the wild and no public exploit code.
Sources
Also known as AZL-107957, DEBIAN-CVE-2026-91926, ECHO-50df-2369-6751, GHSA-x7fj-4fx4-9f96, UBUNTU-CVE-2026-91926.