CVE-2026-57915

7.3 Élevée

Publiée le 26/06/2026 à 15:16 · Modifiée le 03/08/2026 à 15:18 · Analyse NVD reportée · Source : security@apache.org

Description

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Kerby
Red Hat AMQ Clients
Red Hat Data Grid 8
Red Hat Fuse 7
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat streams for Apache Kafka 2
Red Hat streams for Apache Kafka 3

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.3 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L`
3.1	7.3 Élevée	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L`

Faiblesses (CWE)

CWE-304
CWE-358

Références

https://lists.apache.org/thread/1y3glgh3kzwoxo5m2lq504cjlh1dsrfh
http://www.openwall.com/lists/oss-security/2026/06/26/8
https://access.redhat.com/security/cve/CVE-2026-57915
https://bugzilla.redhat.com/show_bug.cgi?id=2493407
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57915.json

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories