Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2009-0845

19
FAUCET Score

CVE-2009-0845 describes a denial-of-service vulnerability in MIT Kerberos 5 versions 1.5 through 1.6.3, specifically within the spnego_gss_accept_sec_context function when SPNEGO is utilized. This flaw allows remote attackers to trigger a NULL pointer dereference and daemon crash by sending invalid ContextFlags data in a negTokenInit token. The vulnerability has a CVSS score of 5.0, indicating a medium severity with low attack complexity and no authentication required, leading to a partial availability impact. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage regarding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
5-1.6.3CPE matchmatch criteria
cpe:2.3:a:mit:kerberos:5-1.6.3:*:*:*:*:*:*:*
1.5CPE matchmatch criteria
cpe:2.3:a:mit:kerberos_5:1.5:*:*:*:*:*:*:*
1.5.1CPE matchmatch criteria
cpe:2.3:a:mit:kerberos_5:1.5.1:*:*:*:*:*:*:*
1.5.2CPE matchmatch criteria
cpe:2.3:a:mit:kerberos_5:1.5.2:*:*:*:*:*:*:*
1.5.3CPE matchmatch criteria
cpe:2.3:a:mit:kerberos_5:1.5.3:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

5.0MEDIUM

AV:N/AC:L/Au:N/C:N/I:N/A:P

Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Exploitability Score
10.0
Impact Score
2.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
5.63%
Probability of exploitation in next 30 days
EPSS Percentile
92.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0563 is in the 89th percentile among its peer group of 23,725 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: krb5-0:1.6.1-31.el5_3.3
View patch

Vendor Advisories (1)

redhatCVE-2009-0845Important

krb5: NULL pointer dereference in GSSAPI SPNEGO (MITKRB5-SA-2009-001)

Mar 13, 2009

References

krbdev.mit.edu / rt/Ticket/Display.html
lists.apple.com / archives/security-announce/2009/May/msg00002.html
secunia.com / advisories/34347
Vendor Advisory
secunia.com / advisories/34594
secunia.com / advisories/34617
secunia.com / advisories/34622
secunia.com / advisories/34628
secunia.com / advisories/34630
secunia.com / advisories/34637
secunia.com / advisories/34640
secunia.com / advisories/34734
secunia.com / advisories/35074
Vendor Advisory
security.gentoo.org / glsa/glsa-200904-09.xml
exchange.xforce.ibmcloud.com / vulnerabilities/49448
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10044
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6449
src.mit.edu / fisheye/browse/krb5/trunk/src/lib/gssapi/spnego/spnego_mech.c
Exploit
src.mit.edu / fisheye/changelog/krb5
Vendor Advisory
sunsolve.sun.com / search/document.do
support.apple.com / kb/HT3549
support.avaya.com / elmodocs2/security/ASA-2009-142.htm
support.novell.com / docs/Readmes/InfoDocument/patchbuilder/readme_5047180.html
support.novell.com / docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html
redhat.com / archives/fedora-package-announce/2009-April/msg00205.html
redhat.com / archives/fedora-package-announce/2009-April/msg00206.html
web.mit.edu / kerberos/advisories/MITKRB5-SA-2009-001.txt
wiki.rpath.com / Advisories:rPSA-2009-0058
wiki.rpath.com / wiki/Advisories:rPSA-2009-0058
www-01.ibm.com / support/docview.wss
kb.cert.org / vuls/id/662091
US Government Resource
mandriva.com / security/advisories
redhat.com / support/errata/RHSA-2009-0408.html
securityfocus.com / archive/1/502526/100/0/threaded
securityfocus.com / archive/1/502546/100/0/threaded
securityfocus.com / bid/34257
securitytracker.com / id
ubuntu.com / usn/usn-755-1
us-cert.gov / cas/techalerts/TA09-133A.html
US Government Resource
vupen.com / english/advisories/2009/0847
Vendor Advisory
vupen.com / english/advisories/2009/0976
vupen.com / english/advisories/2009/1057
vupen.com / english/advisories/2009/1106
vupen.com / english/advisories/2009/1297
vupen.com / english/advisories/2009/2248
Vendor Advisory