Log in Start free

Vulnerability · Published Nov 12, 2025 · Assigned by redhat

CVE-2025-59089Python-kdcproxy: remote dos via unbounded tcp upstream buffering

Medium 5.9

In plain English

A medium-severity resource allocation without limits in kdcproxy from latchset. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message. This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8bind-dyndb-ldap11.6-6.module_el8.10.0+3980+d78e8e90ALSA-2025:21140
AlmaLinux:8custodia0.6.0-3.module_el8.6.0+2881+2f24dc92ALSA-2025:21140
AlmaLinux:8ipa-client4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-client-common4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-client-epn4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-client-samba4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-common4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-healthcheck0.12-6.module_el8.10.0+4036+84b152d9ALSA-2025:21140
AlmaLinux:8ipa-healthcheck-core0.12-6.module_el8.10.0+4036+84b152d9ALSA-2025:21140
AlmaLinux:8ipa-python-compat4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-selinux4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-server4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-server-common4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-server-dns4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8ipa-server-trust-ad4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8opendnssec2.1.7-2.module_el8.10.0+3980+d78e8e90ALSA-2025:21140
AlmaLinux:8python3-custodia0.6.0-3.module_el8.6.0+2881+2f24dc92ALSA-2025:21140
AlmaLinux:8python3-ipaclient4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8python3-ipalib4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8python3-ipaserver4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8python3-ipatests4.9.13-20.module_el8.10.0+4050+3b475c71ALSA-2025:21140
AlmaLinux:8python3-jwcrypto0.5.0-2.module_el8.10.0+3844+20e075e5ALSA-2025:21140
AlmaLinux:10python3-kdcproxy1.0.0-19.el10_1ALSA-2025:21142
AlmaLinux:8python3-kdcproxy0.4-5.module_el8.10.0+4069+1d9eaa78.2ALSA-2025:21140
AlmaLinux:9python3-kdcproxy1.0.0-9.el9_7ALSA-2025:21139
AlmaLinux:8python3-pyusb1.0.0-9.1.module_el8.7.0+3349+cfeff52eALSA-2025:21140
AlmaLinux:8python3-qrcode5.3-1.module_el8.10.0+3942+63b39a46ALSA-2025:21140
AlmaLinux:8python3-qrcode-core5.3-1.module_el8.10.0+3942+63b39a46ALSA-2025:21140
AlmaLinux:8python3-yubico1.3.2-9.1.module_el8.7.0+3349+cfeff52eALSA-2025:21140
AlmaLinux:8slapi-nis0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1ALSA-2025:21140
AlmaLinux:8softhsm2.6.0-5.module_el8.6.0+3031+2f24dc92ALSA-2025:21140
AlmaLinux:8softhsm2.6.0-5.module_el8.6.0+2881+2f24dc92ALSA-2025:21140
AlmaLinux:8softhsm-devel2.6.0-5.module_el8.6.0+3031+2f24dc92ALSA-2025:21140
AlmaLinux:8softhsm-devel2.6.0-5.module_el8.6.0+2881+2f24dc92ALSA-2025:21140
Debian:12python-kdcproxyno fix listedDEBIAN-CVE-2025-59089
Debian:13python-kdcproxyno fix listedDEBIAN-CVE-2025-59089
Debian:14python-kdcproxyno fix listedDEBIAN-CVE-2025-59089
Rocky Linux:8bind-dyndb-ldap0:11.6-6.module+el8.10.0+1960+1ed527b3RLSA-2025:21140
Rocky Linux:8custodia0:0.6.0-3.module+el8.9.0+1371+ffa84eb9RLSA-2025:21140
Rocky Linux:8ipa0:4.9.13-20.module+el8.10.0+2066+d74ade98RLSA-2025:21140
Rocky Linux:8ipa0:4.9.13-20.module+el8.10.0+2067+377bdd64RLSA-2025:21140
Rocky Linux:8ipa-healthcheck0:0.12-6.module+el8.10.0+2053+a0a9dc19RLSA-2025:21140
Rocky Linux:8ipa-healthcheck0:0.12-6.module+el8.10.0+2054+aa003774RLSA-2025:21140
Rocky Linux:8opendnssec0:2.1.7-2.module+el8.10.0+1960+1ed527b3RLSA-2025:21140
Rocky Linux:8python-jwcrypto0:0.5.0-2.module+el8.10.0+1818+2dfda7a6RLSA-2025:21140
Rocky Linux:8python-jwcrypto0:0.5.0-2.module+el8.10.0+1819+0aeba2f1RLSA-2025:21140
Rocky Linux:10python-kdcproxy0:1.0.0-19.el10_1RLSA-2025:21142
Rocky Linux:8python-kdcproxy0:0.4-5.module+el8.10.0+2094+d7886766.2RLSA-2025:21140
Rocky Linux:8python-kdcproxy0:0.4-5.module+el8.10.0+1915+3c70f7d9.1RLSA-2025:21140
Rocky Linux:8python-kdcproxy0:0.4-5.module+el8.9.0+1371+ffa84eb9RLSA-2025:21140
Rocky Linux:9python-kdcproxy0:1.0.0-9.el9_7RLSA-2025:21139
Rocky Linux:8python-qrcode0:5.3-1.module+el8.10.0+1915+3c70f7d9RLSA-2025:21140
Rocky Linux:8python-qrcode0:5.3-1.module+el8.10.0+1916+6bb8cf6bRLSA-2025:21140
Rocky Linux:8python-yubico0:1.3.2-9.1.module+el8.9.0+1372+09f67869RLSA-2025:21140
Rocky Linux:8python-yubico0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9RLSA-2025:21140
Rocky Linux:8pyusb0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9RLSA-2025:21140
Rocky Linux:8pyusb0:1.0.0-9.1.module+el8.9.0+1372+09f67869RLSA-2025:21140
Rocky Linux:8slapi-nis0:0.60.0-4.module+el8.9.0+1573+39ab85f4RLSA-2025:21140
Rocky Linux:8softhsm0:2.6.0-5.module+el8.9.0+1371+ffa84eb9RLSA-2025:21140
Ubuntu:22.04:LTSpython-kdcproxyno fix listedUBUNTU-CVE-2025-59089
Ubuntu:24.04:LTSpython-kdcproxyno fix listedUBUNTU-CVE-2025-59089
Ubuntu:25.10python-kdcproxyno fix listedUBUNTU-CVE-2025-59089
Ubuntu:26.04:LTSpython-kdcproxyno fix listedUBUNTU-CVE-2025-59089
Ubuntu:26.10python-kdcproxyno fix listedUBUNTU-CVE-2025-59089

Affected products (as reported)

VendorProductVersions
latchset kdcproxy 0 – before 1.1.0
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References