CVE-2020-28196

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-06 · updated 2026-10-14
Weakness: CWE-674

Description

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Affected products

Fedoraproject Fedora: 31
MIT Kerberos 5: before 1.17.2; from 1.18.0 before 1.18.3 — fixed in 1.17.2, 1.18.3
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Cloud Backup: all versions
OnCommand Insight: all versions
NetApp OnCommand Workflow Automation: all versions
NetApp SnapCenter: all versions
Oracle Communications Cloud Native Core Policy: 1.14.0
Oracle Communications Offline Mediation Controller: 12.0.0.3.0
Oracle Corporation Communications Pricing Design Center: 12.0.0.3.0
MySQL Server: through 8.0.23

How to fix

Upgrade to a fixed version: MIT Kerberos 5 1.17.2, 1.18.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-28196 or the next vulnerability affects your stack