The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19357 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    Security Fix(es):

    * krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read     (CVE-2026-40356)

    * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism     (CVE-2026-40355)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1680 advisory.

    In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls     gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An     unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
    (CVE-2026-40355)

    In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read     if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in     /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to     terminate in parse_message. (CVE-2026-40356)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0118 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-40355:
    A flaw was found in MIT Kerberos 5 (krb5). An unauthenticated remote attacker can exploit a NULL pointer     dereference vulnerability by calling `gss_accept_sec_context()` on a system with a NegoEx mechanism     registered. This can lead to the termination of the process, resulting in a Denial of Service (DoS).

    CVE-2026-40356:
    A flaw was found in MIT Kerberos 5 (krb5). An unauthenticated remote attacker can exploit an integer     underflow and an out-of-bounds read vulnerability by calling `gss_accept_sec_context()` on a system with a     NegoEx mechanism registered. This can lead to the process terminating, resulting in a Denial of Service     (DoS).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2e9fe57a46 advisory.

    Automatic update for krb5-1.22.2-7.fc45.

    ##### **Changelog**

    ```
    * Tue Apr 28 2026 Julien Rische <jrische@redhat.com> - 1.22.2-7
    - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    - resolves: rhbz#2463398
    - resolves: rhbz#2463395

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read     if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in     /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to     terminate in parse_message.(CVE-2026-40356)

    In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls     gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An     unauthenticated remote attacker can trigger this, causing the process to terminate in     parse_nego_message.(CVE-2026-40355)

Tenable has extracted the preceding description block directly from the EulerOS krb5 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls     gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An     unauthenticated remote attacker can trigger this, causing the process to terminate in     parse_nego_message.(CVE-2026-40355)

    In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read     if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in     /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to     terminate in parse_message.(CVE-2026-40356)

Tenable has extracted the preceding description block directly from the EulerOS krb5 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19357 advisory.

    * krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read     (CVE-2026-40356)

    * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism     (CVE-2026-40355)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0386 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-40355:
    In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls     gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An     unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

    CVE-2026-40356:
    In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read     if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in     /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to     terminate in parse_message.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.6 advisory.

  - NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure. (CVE-2026-33278)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in     the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable     characters (which would need escaping), the calculation of the length of the escaped string could     overflow, leading to a potential write off the end of the newly allocated string. (CVE-2025-13601)

  - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)

  - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
315480	RHEL 9 : krb5 (RHSA-2026:19357)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/5/19	medium
315640	Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2026-1680)	Nessus	Amazon Linux Local Security Checks	2026/5/20	2026/5/20	medium
316642	Alibaba Cloud Linux 3 : 0118: krb5 (ALINUX3-SA-2026:0118)	Nessus	Alibaba Cloud Linux Local Security Checks	2026/5/25	2026/5/25	medium
311064	Fedora 45 : krb5 (2026-2e9fe57a46)	Nessus	Fedora Local Security Checks	2026/4/29	2026/4/29	medium
332859	EulerOS 2.0 SP15 : krb5 (EulerOS-SA-2026-2890)	Nessus	Huawei Local Security Checks	2026/8/6	2026/8/6	high
332875	EulerOS 2.0 SP13 : krb5 (EulerOS-SA-2026-2972)	Nessus	Huawei Local Security Checks	2026/8/6	2026/8/6	high
318651	RockyLinux 9 : krb5 (RLSA-2026:19357)	Nessus	Rocky Linux Local Security Checks	2026/6/4	2026/8/27	high
316701	TencentOS Server 3: krb5 (TSSA-2026:0386)	Nessus	Tencent Local Security Checks	2026/5/26	2026/5/26	medium
328839	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.6)	Nessus	Misc.	2026/7/21	2026/8/24	critical

检测

插件搜索

medium

medium

medium

medium

high

high

high

medium

critical