Hi Sam, On Fri, Oct 09, 2026 at 02:30:05PM -0600, Sam Hartman wrote: > >>>>> "Salvatore" == Salvatore Bonaccorso <[email protected]> writes: > > > Salvatore> CVE-2026-107708[0]: | MIT krb5 through 1.22.2 contains a > Salvatore> NULL pointer dereference | vulnerability in the KDC's > Salvatore> get_pac_princ_with_realm() that returns | success while > > > In the default Debian configuration this is significantly mitigated by > our systemd restart policy: the KDC will restart on such a crash. > Obviously I should fix, but worth noting this has lower impact for > Debian.
Agreed, we marked the issues as no-dsa in the tracker! I think they are as well just conidered low severity issues upstream reading the upstream issues about it. Once they are fixed in unstable we might go via trixie-pu update for stable as well, if your time permits! Regards, Salvatore
