CVE-2021-36222: Debian Linux

High severity, CVSS 7.5. EPSS: 10.3% chance of exploitation in the next 30 days.

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

Affected products

• Debian Debian Linux: version 10.0 only
• Mit Kerberos 5: before 1.18.4 (fixed in 1.18.4); from 1.19.0, before 1.19.2 (fixed in 1.19.2)
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Oncommand Insight: affected versions not specified
• Netapp Oncommand Workflow Automation: affected versions not specified
• Netapp Snapcenter: affected versions not specified
• Oracle MySQL Server: from 8.0.0, up to and including 8.0.26

Published 2021-07-22. Last modified 2026-06-17.