CVE-2021-37750: Debian Linux

Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days.

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 33 only
• Mit Kerberos 5: before 1.18.5 (fixed in 1.18.5); from 1.19.0, before 1.19.3 (fixed in 1.19.3)
• Oracle Communications Cloud Native Core Network Slice Selection Function: version 22.1.0 only
• Starwindsoftware Starwind Virtual San: version v8r13 only

Published 2021-08-23. Last modified 2026-06-17.