Description

Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-19T23:16:21.200Z",
  "pubdate": "2026-08-19T23:16:21.200Z",
  "executiveSummary": "A denial of service vulnerability exists within the Kerberos protocol dissector affecting versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. This flaw allows an unauthenticated remote attacker to cause an application crash by supplying a specifically crafted payload processed by the vulnerable dissector. The primary impact is the complete termination of the affected service, leading to service unavailability and potential disruption of dependent network analysis or processing pipelines. The vulnerability stems from improper handling of malformed protocol data within the parsing routine, resulting in memory corruption or exception states that the application fails to handle gracefully. Exploitation requires the ability to transmit crafted network traffic or data packets to the system executing the vulnerable dissector component. No authentication or elevated privileges are required to trigger the crash condition, lowering the barrier for potential exploitation against exposed systems. Risk implications include operational downtime, loss of real-time monitoring capabilities, and potential cascading availability failures in environments relying on the affected software for traffic inspection or protocol analysis. Remediation requires updating the affected product to non-vulnerable versions as specified by the vendor.",
  "technicalDetails": "The vulnerability resides in the Kerberos protocol dissector component responsible for parsing and interpreting Kerberos network traffic and protocol messages. Specifically, versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18 fail to properly validate and bound-check input fields when processing deeply nested, malformed, or unexpected protocol structures.\nThe root cause is attributable to improper input sanitization and error handling within the parsing logic of the Kerberos dissector. When the vulnerable component encounters a crafted payload designed to violate expected protocol schemas, it experiences an unhandled exception, null pointer dereference, or buffer management failure. This anomalous condition precipitates an abnormal termination of the host application process, effectively instigating a denial of service.\nThe attack flow proceeds as follows: An unauthenticated attacker crafts a malicious packet or data stream containing structurally manipulated Kerberos protocol elements. The attacker transmits this payload across the network or injects it into a data feed monitored or processed by the vulnerable application. Upon receipt, the application invokes the Kerberos protocol dissector to inspect the payload. As the dissector attempts to parse the malicious fields without adequate bounds checking or validation, the internal parsing logic encounters an invalid state. The resulting fault triggers an application crash, halting all further packet analysis and terminating the process.\nNetwork exposure is a prerequisite for remote exploitation, as the vulnerable component must process data originating from untrusted sources, such as network interfaces capturing live traffic or ingestion pipelines processing external captures. The vulnerability can be triggered without prior authentication or privileged access, provided the attacker can reach the protocol processing interface. Post-exploitation impact is strictly limited to availability, as the vulnerability manifests as a crash rather than a mechanism for remote code execution or unauthorized data access. However, continuous triggering of the crash condition can sustain a prolonged denial of service state against the targeted monitoring infrastructure."
}