products / mit_kerberos

MIT Kerberos

MIT Kerberos is the reference Kerberos 5 implementation. It ships the KDC, kadmind, client libraries, and GSSAPI stack used across Linux, macOS, FreeIPA, and many enterprise SSO deployments. Attack surface includes unauthenticated KDC preauth paths, PAC and authorization-data parsing on ticket-granting services, and GSS message token handling in application servers. NVD tracks it as mit:kerberos_5. Attestd scopes matches to that CPE so unrelated vendor Kerberos entries do not inflate results.

api usage

Querying MIT Kerberos

product slugmit_kerberos

version format1.20.0, 1.22.3, 1.19.4

bash

curl "https://api.attestd.io/v1/check?product=mit_kerberos&version=1.20.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

MIT Kerberos 1.20.0 returns risk_state: "high" with CVE-2023-36054 in cve_ids, memory-corruption risk factors, and fixed_version: "1.20.1".

json

{
  "product": "mit_kerberos",
  "version": "1.20.0",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "1.22.3",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2022-42898",
    "CVE-2023-36054",
    "CVE-2024-37370",
    "CVE-2024-37371",
    "CVE-2026-40355",
    "CVE-2026-40356"
  ],
  "cves": null,
  "max_epss": 0.06419,
  "last_updated": "2026-07-15T18:23:27.492598Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

MIT Kerberos 1.22.3 includes the GSS message-token length fixes from CVE-2024-37371 and sits past the 1.20.1 / 1.21.2 patch lines used for earlier PAC and TGS issues.

bash

curl "https://api.attestd.io/v1/check?product=mit_kerberos&version=1.22.3" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Recent MIT Kerberos CVEs focus on memory safety in PAC parsing, TGS authorization-data handling, GSS token length checks, and KDC preauthentication. Several require authentication or hit mainly 32-bit KDC builds, but unauthenticated KDC crashes remain a recurring availability risk on exposed realms.

CVE	Description	Affects	CVSS
`CVE-2024-37371`	Invalid GSS message-token lengths cause invalid memory reads that leak information or crash the process.	< 1.21.3	9.1
`CVE-2022-42898`	PAC parsing integer overflows enable remote code execution on 32-bit KDC, kadmind, and GSS servers.	≥1.8 <1.19.4 / 1.20.x <1.20.1	8.8
`CVE-2023-39975`	An authenticated user triggers a double-free in TGS authorization-data handling.	≥1.21 <1.21.2	8.8
`CVE-2021-36222`	EC preauth handling lets remote attackers crash the KDC.	< 1.18.4 / ≥1.19.0 <1.19.2	7.5

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

MIT Kerberos CPE namespace

NVD uses a dedicated MIT product identifier for Kerberos 5. Bare keyword searches on "Kerberos" pull in unrelated vendor implementations:

cpe:2.3:a:mit:kerberos_5MIT krb5 KDC, libraries, and GSSAPI

Attestd maps mit_kerberos to this CPE and keeps results scoped to the MIT release line.

All products FreeIPA Samba Quickstart