Description

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-15T12:17:54.500Z",
  "pubdate": "2026-09-15T12:17:54.500Z",
  "executiveSummary": "A memory leak vulnerability exists within the gss-ntlmssp NTLM target-info parser. The flaw occurs during the processing of NTLM CHALLENGE messages when duplicated string-valued AV_PAIR entries are encountered. This failure to properly manage heap memory leads to a denial of service (DoS) condition via gradual memory exhaustion on the client side.\nThe vulnerability is classified as an improper resource management issue (CWE-401). Successful exploitation allows a malicious or compromised man-in-the-middle (MitM) server to induce significant resource consumption on the authenticated client. By repeatedly injecting crafted NTLM authentication sequences containing redundant AV_PAIR structures, an attacker can force the client to consume available memory, eventually leading to process crashes or system instability.\nThe impact is primarily availability degradation. Given that NTLM authentication is often performed during initial connection or service negotiation, this flaw poses a risk to service continuity for any client utilizing gss-ntlmssp. Exploitation does not require prior authentication, as the vulnerability is triggered during the NTLM handshake phase.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of state during the parsing of the NTLM target-info structure. The gss-ntlmssp library iterates through the list of AV_PAIRs provided within an NTLM CHALLENGE message. When the parser encounters a string-valued AV_PAIR, it performs a dynamic memory allocation to store the received data. However, the logic fails to account for instances where an attacker provides multiple AV_PAIR entries of the same type within a single message.\nWhen a duplicate AV_PAIR type is processed, the parser performs a new allocation for the secondary entry without invoking the necessary free() function on the pointer referencing the original, preceding allocation. Because the internal structure pointer is overwritten by the new memory address, the reference to the initial allocation is lost, resulting in a persistent memory leak.\nThe attack flow proceeds as follows: 1) An attacker acting as a malicious server or a man-in-the-middle positions themselves between the client and the authentication endpoint. 2) The attacker intercepts or initiates an NTLM handshake. 3) The attacker responds with a crafted NTLM CHALLENGE message that deliberately includes multiple, identical AV_PAIR entries (such as MsvAvNbDomainName or MsvAvNbComputerName). 4) Upon receiving the message, the client-side gss-ntlmssp parser iterates through the malformed list. 5) For each duplicate entry, a block of memory is allocated and subsequently orphaned in the heap. 6) By repeating this process across multiple authentication attempts or within a single large message, the attacker causes the client process to steadily consume increasing amounts of memory.\nThe vulnerable component is the NTLM target-info parsing logic within the gss-ntlmssp library. This flaw is reachable from a remote, unauthenticated attacker, provided they can influence the NTLM handshake process. Because this happens during the early negotiation phase, standard authentication security controls are ineffective at preventing the memory allocation leak. The ultimate post-exploitation impact is the degradation of the client service, which may manifest as performance degradation, excessive swap usage, or a termination of the client application due to memory allocation failure (OOM killer or malloc returning NULL)."
}