Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by redhat

CVE-2026-91926Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair entries in ntlm challenge

Low 3.7

In plain English

A low-severity memory leak in Red Hat Enterprise Linux 8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 68.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gss-ntlmsspno fix listedDEBIAN-CVE-2026-91926
Debian:13gss-ntlmsspno fix listedDEBIAN-CVE-2026-91926
Debian:14gss-ntlmsspno fix listedDEBIAN-CVE-2026-91926
Ubuntu:24.04:LTSgss-ntlmsspno fix listedUBUNTU-CVE-2026-91926
Ubuntu:26.04:LTSgss-ntlmsspno fix listedUBUNTU-CVE-2026-91926
Ubuntu:26.10gss-ntlmsspno fix listedUBUNTU-CVE-2026-91926

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References