Skip to content
Fencer Vulns
medium 5.9

CVE-2025-59089 json

Python-kdcproxy: remote dos via unbounded tcp upstream buffering

published 2025-11-12 11 mo ago modified 2026-06-30 4 mo ago also EUVD-2025-131919

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message. This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients.

Patch / fix

  • latchset kdcproxy 1.1.0
  • Red Hat Red Hat Enterprise Linux 10 0:1.0.0-19.el10_1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.0.0-19.el10_0
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:0.3.2-3.el7_9.3
  • Red Hat Red Hat Enterprise Linux 8 8100020251028161822.823393f5, 8100020251103113748.143e9e98
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020251106022345.792f4060
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020251103205102.5b01ab7e
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020251103205102.5b01ab7e
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020251030180424.ada582f1
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020251030180424.ada582f1
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020251030180424.ada582f1
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020251029082621.b0a6ceea
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020251029082621.b0a6ceea
  • Red Hat Red Hat Enterprise Linux 9 0:1.0.0-9.el9_7
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:1.0.0-7.el9_0.1
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.0.0-7.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:1.0.0-7.el9_4.1
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.0.0-9.el9_6
  • python-kdcproxy RHEL 10.1 1.0.0-19.el10_1
  • python3-kdcproxy RHEL 10.1 1.0.0-19.el10_1
  • ipa RHEL 8 4.9.13-20.module+el8.10.0+23617+3e211261
  • pyusb RHEL 8 1.0.0-9.1.module+el8.9.0+18920+2223d05e
  • softhsm RHEL 8 2.6.0-5.module+el8.9.0+18911+94941f82
  • custodia RHEL 8 0.6.0-3.module+el8.9.0+18911+94941f82
  • slapi-nis RHEL 8 0.60.0-4.module+el8.10.0+20723+03062ebd
  • ipa-client RHEL 8 4.9.13-20.module+el8.10.0+23617+3e211261

red hat advisories RHSA-2025:22982RHSA-2025:21821RHSA-2025:21819RHSA-2025:21820RHSA-2025:21818RHSA-2025:21806

  • python3-kdcproxy AlmaLinux 9 1.0.0-9.el9_7
  • softhsm AlmaLinux 8 2.6.0-5.module_el8.6.0+2881+2f24dc92
  • softhsm AlmaLinux 8 2.6.0-5.module_el8.6.0+3031+2f24dc92
  • custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
  • slapi-nis AlmaLinux 8 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1
  • ipa-client AlmaLinux 8 4.9.13-20.module_el8.10.0+4050+3b475c71
  • ipa-common AlmaLinux 8 4.9.13-20.module_el8.10.0+4050+3b475c71
  • ipa-server AlmaLinux 8 4.9.13-20.module_el8.10.0+4050+3b475c71

almalinux advisories ALSA-2025:21139ALSA-2025:21140ALSA-2025:21142

  • ipa Rocky Linux 8 4.9.13-20.module+el8.10.0+2067+377bdd64
  • ipa Rocky Linux 8 4.9.13-20.module+el8.10.0+2066+d74ade98
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1372+09f67869
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9
  • softhsm Rocky Linux 8 2.6.0-5.module+el8.9.0+1371+ffa84eb9
  • custodia Rocky Linux 8 0.6.0-3.module+el8.9.0+1371+ffa84eb9
  • slapi-nis Rocky Linux 8 0.60.0-4.module+el8.9.0+1573+39ab85f4
  • opendnssec Rocky Linux 8 2.1.7-2.module+el8.10.0+1960+1ed527b3

rocky linux advisories RLSA-2025:21140RLSA-2025:21142RLSA-2025:21139

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-59089 updated cvss 5.9

python-kdcproxy: Remote DoS via unbounded TCP upstream buffering

  • Red Hat Enterprise Linux AppStream (v. 8) ipa 4.9.13-20.module+el8.10.0+23610+7d6e87e5, ipa 4.9.13-20.module+el8.10.0+23617+3e211261, pyusb 1.0.0-9.1.module+el8.9.0+18911+94941f82, pyusb 1.0.0-9.1.module+el8.9.0+18920+2223d05e, softhsm 2.6.0-5.module+el8.9.0+18911+94941f82, custodia 0.6.0-3.module+el8.9.0+18911+94941f82, +50 more
    fixed: vendor fix RHSA-2025:21140
  • Red Hat Enterprise Linux AppStream (v. 9) python-kdcproxy 1.0.0-9.el9_7, python3-kdcproxy 1.0.0-9.el9_7
    fixed: vendor fix RHSA-2025:21139
  • Red Hat Enterprise Linux AppStream (v. 10) python-kdcproxy 1.0.0-19.el10_1, python3-kdcproxy 1.0.0-19.el10_1
    fixed: vendor fix RHSA-2025:21142
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, softhsm 2.4.0-4.module+el8.2.0+5779+a38c524f, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, ipa 4.8.4-14.module+el8.2.0+23544+91c528c8.10, opendnssec 1.4.14-1.module+el8.1.0+4098+f286395e, slapi-nis 0.56.3-3.module+el8.2.0+10782+8facb0b2, +28 more
    fixed: vendor fix RHSA-2025:21821
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, ipa 4.9.2-10.module+el8.4.0+23621+13d4146a.4, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, python-qrcode 5.1-12.module+el8.1.0+4098+f286395e, +29 more
    fixed: vendor fix RHSA-2025:21820
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, ipa 4.9.8-13.module+el8.6.0+23614+ac2d171f.3, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, slapi-nis 0.60.0-1.module+el8.6.0+16878+6c033536, +29 more Red Hat Enterprise Linux AppStream E4S (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, ipa 4.9.8-13.module+el8.6.0+23614+ac2d171f.3, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, slapi-nis 0.60.0-1.module+el8.6.0+16878+6c033536, +29 more
    fixed: vendor fix RHSA-2025:21819
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) custodia 0.6.0-3.module+el8.1.0+4098+f286395e, ipa 4.9.11-11.module+el8.8.0+23530+2673a519.3, pyusb 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, slapi-nis 0.60.0-4.module+el8.8.0+20635+330e3683, +29 more
    fixed: vendor fix RHSA-2025:21818
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) python-kdcproxy 1.0.0-7.el9_0.1, python3-kdcproxy 1.0.0-7.el9_0.1
    fixed: vendor fix RHSA-2025:21806
show 8 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) python-kdcproxy 1.0.0-7.el9_2.1, python3-kdcproxy 1.0.0-7.el9_2.1
    fixed: vendor fix RHSA-2025:21448
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-kdcproxy 1.0.0-19.el10_0, python3-kdcproxy 1.0.0-19.el10_0
    fixed: vendor fix RHSA-2025:21141
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) python-kdcproxy 1.0.0-7.el9_4.1, python3-kdcproxy 1.0.0-7.el9_4.1
    fixed: vendor fix RHSA-2025:21748
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) python-kdcproxy 1.0.0-9.el9_6, python3-kdcproxy 1.0.0-9.el9_6
    fixed: vendor fix RHSA-2025:21138
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, ipa 4.9.2-10.module+el8.4.0+23621+13d4146a.4, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, python-qrcode 5.1-12.module+el8.1.0+4098+f286395e, +29 more
    fixed: vendor fix RHSA-2025:21820
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, ipa 4.9.8-13.module+el8.6.0+23614+ac2d171f.3, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, slapi-nis 0.60.0-1.module+el8.6.0+16878+6c033536, +29 more
    fixed: vendor fix RHSA-2025:21819
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) custodia 0.6.0-3.module+el8.1.0+4098+f286395e, ipa 4.9.11-11.module+el8.8.0+23530+2673a519.3, pyusb 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8, slapi-nis 0.60.0-4.module+el8.8.0+20635+330e3683, +29 more
    fixed: vendor fix RHSA-2025:21818
  • Red Hat Enterprise Linux Server (v. 7 ELS) python-kdcproxy 0.3.2-3.el7_9.3
    fixed: vendor fix RHSA-2025:22982

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
11 mo ago

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • latchset kdcproxy
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.