Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2025-59089

Python-kdcproxy: remote dos via unbounded tcp upstream buffering

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message. This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

latchset kdcproxy

Default version status: unaffected

  • 0 to < 1.1.0affected

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

  • 0:1.0.0-19.el10_1 to < *unaffected

Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

Default version status: affected

  • 0:1.0.0-19.el10_0 to < *unaffected

Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

Default version status: affected

  • 0:0.3.2-3.el7_9.3 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 8100020251103113748.143e9e98 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 8100020251028161822.823393f5 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support

Default version status: affected

  • 8020020251106022345.792f4060 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

Default version status: affected

  • 8040020251103205102.5b01ab7e to < *unaffected

Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Default version status: affected

  • 8040020251103205102.5b01ab7e to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Default version status: affected

  • 8060020251030180424.ada582f1 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Default version status: affected

  • 8060020251030180424.ada582f1 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

Default version status: affected

  • 8060020251030180424.ada582f1 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Default version status: affected

  • 8080020251029082621.b0a6ceea to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

Default version status: affected

  • 8080020251029082621.b0a6ceea to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:1.0.0-9.el9_7 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Default version status: affected

  • 0:1.0.0-7.el9_0.1 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Default version status: affected

  • 0:1.0.0-7.el9_2.1 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support

Default version status: affected

  • 0:1.0.0-7.el9_4.1 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support

Default version status: affected

  • 0:1.0.0-9.el9_6 to < *unaffected

References