CVE-2025-59088: Latchset Kdcproxy

High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days.

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.

Affected products

  • Latchset Kdcproxy: before 1.1.0 (fixed in 1.1.0)
  • Red Hat Red Hat Enterprise Linux 10: before 0:1.0.0-19.el10_1 (fixed in 0:1.0.0-19.el10_1)
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: before 0:1.0.0-19.el10_0 (fixed in 0:1.0.0-19.el10_0)
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support: before 0:0.3.2-3.el7_9.3 (fixed in 0:0.3.2-3.el7_9.3)
  • Red Hat Red Hat Enterprise Linux 8: before 8100020251103113748.143e9e98 (fixed in 8100020251103113748.143e9e98); before 8100020251028161822.823393f5 (fixed in 8100020251028161822.823393f5)
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support: before 8020020251106022345.792f4060 (fixed in 8020020251106022345.792f4060)
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: before 8040020251103205102.5b01ab7e (fixed in 8040020251103205102.5b01ab7e)
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: before 8040020251103205102.5b01ab7e (fixed in 8040020251103205102.5b01ab7e)
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: before 8060020251030180424.ada582f1 (fixed in 8060020251030180424.ada582f1)
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service: before 8060020251030180424.ada582f1 (fixed in 8060020251030180424.ada582f1)
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services For SAP Solutions: before 8060020251030180424.ada582f1 (fixed in 8060020251030180424.ada582f1)
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service: before 8080020251029082621.b0a6ceea (fixed in 8080020251029082621.b0a6ceea)
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions: before 8080020251029082621.b0a6ceea (fixed in 8080020251029082621.b0a6ceea)
  • Red Hat Red Hat Enterprise Linux 9: before 0:1.0.0-9.el9_7 (fixed in 0:1.0.0-9.el9_7)
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions: before 0:1.0.0-7.el9_0.1 (fixed in 0:1.0.0-7.el9_0.1)
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions: before 0:1.0.0-7.el9_2.1 (fixed in 0:1.0.0-7.el9_2.1)
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support: before 0:1.0.0-7.el9_4.1 (fixed in 0:1.0.0-7.el9_4.1)
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: before 0:1.0.0-9.el9_6 (fixed in 0:1.0.0-9.el9_6)

Published 2025-11-12. Last modified 2026-06-30.