Skip to content
Fencer Intel
medium 5.9

CVE-2025-3576 json

Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions

published last yr. modified 4d ago also EUVD-2025-10925

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits
0
none known

Summary

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.

Patch / fix

  • web.mit.edu krb5 1.22
  • Red Hat Red Hat Enterprise Linux 10 0:1.21.3-8.el10_0
  • Red Hat Red Hat Enterprise Linux 8 0:1.18.2-32.el8_10
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:1.17-19.el8_2.3
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.18.2-9.el8_4.3
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:1.18.2-9.el8_4.3
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.18.2-16.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:1.18.2-16.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:1.18.2-16.el8_6.4
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:1.18.2-26.el8_8.5
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:1.18.2-26.el8_8.5
  • Red Hat Red Hat Enterprise Linux 9 0:1.21.1-8.el9_6
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:1.19.1-16.el9_0.4
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.20.1-9.el9_2.3
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:1.21.1-2.el9_4.2
  • Red Hat Red Hat Discovery 2 2.0.0-1752592913
  • Siemens RUGGEDCOM ROX MX5000 V2.17.1
  • Siemens RUGGEDCOM ROX MX5000RE V2.17.1
  • Siemens RUGGEDCOM ROX RX1400 V2.17.1
  • Siemens RUGGEDCOM ROX RX1500 V2.17.1
  • Siemens RUGGEDCOM ROX RX1501 V2.17.1
  • Siemens RUGGEDCOM ROX RX1510 V2.17.1
  • Siemens RUGGEDCOM ROX RX1511 V2.17.1
  • Siemens RUGGEDCOM ROX RX1512 V2.17.1
  • Siemens RUGGEDCOM ROX RX1524 V2.17.1
  • Siemens RUGGEDCOM ROX RX1536 V2.17.1
  • Siemens RUGGEDCOM ROX RX5000 V2.17.1
  • krb5 Debian 12 1.20.1-2+deb12u4
  • krb5 Debian 14, Debian 13 1.21.2-1

debian advisories DEBIAN-CVE-2025-3576

  • krb5 Ubuntu 20.04 LTS 1.17-6ubuntu4.11
  • krb5 Ubuntu 22.04 LTS 1.19.2-2ubuntu0.7
  • krb5 Ubuntu 24.04 LTS 1.20.1-6ubuntu2.6
  • krb5 Ubuntu Pro 14.04 LTS 1.12+dfsg-2ubuntu5.4+esm7
  • krb5 Ubuntu Pro 16.04 LTS 1.13.2+dfsg-5ubuntu2.2+esm7
  • krb5 Ubuntu Pro 18.04 LTS 1.16-2ubuntu0.4+esm5

ubuntu advisories UBUNTU-CVE-2025-3576

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • krb5 RHEL 9 1.21.1-8.el9_6
  • libkadm5 RHEL 9 1.21.1-8.el9_6
  • krb5-libs RHEL 9 1.21.1-8.el9_6
  • krb5-pkinit RHEL 9 1.21.1-8.el9_6
  • krb5-server RHEL 9 1.21.1-8.el9_6
  • krb5-server-ldap RHEL 9 1.21.1-8.el9_6
  • krb5-workstation RHEL 9 1.21.1-8.el9_6
  • krb5 RHEL 10.0 1.21.3-8.el10_0

red hat advisories RHSA-2025:15004RHSA-2025:15002RHSA-2025:15003RHSA-2025:15000RHSA-2025:15001RHSA-2025:13777

  • krb5 SLE Micro 5.4, SLE Micro 5.3 1.19.2-150400.3.18.1
  • krb5 SLE Module for Server Applications 15 SP7, SLE Module for Server Applications 15 SP6, SLE Module for Basesystem 15 SP7 +2 more 1.20.1-150600.11.14.1
  • krb5 Linux Micro 6.0 1.20.1-7.1
  • krb5 SLE Micro 5.5 1.20.1-150500.3.17.1
  • krb5 SLE Micro 5.2, SLE Micro 5.1 1.19.2-150300.25.1
  • krb5 SLES LTSS Extended Security 12 SP5 1.16.3-46.21.1

suse advisories SUSE-SU-2025:3729-1SUSE-SU-2025:3699-1SUSE-SU-2025:3698-1SUSE-SU-2025:20719-1SUSE-SU-2025:03270-1SUSE-SU-2025:03227-1

  • libkadm5 AlmaLinux 10 1.21.3-8.el10_0
  • krb5-libs AlmaLinux 10 1.21.3-8.el10_0
  • krb5-pkinit AlmaLinux 10 1.21.3-8.el10_0
  • krb5-server AlmaLinux 10 1.21.3-8.el10_0
  • krb5-server-ldap AlmaLinux 10 1.21.3-8.el10_0
  • krb5-workstation AlmaLinux 10 1.21.3-8.el10_0
  • libkadm5 AlmaLinux 9 1.21.1-8.el9_6
  • krb5-libs AlmaLinux 9 1.21.1-8.el9_6

almalinux advisories ALSA-2025:9418ALSA-2025:9430ALSA-2025:8411

  • krb5 Rocky Linux 9 1.21.1-8.el9_6
  • krb5 Rocky Linux 10 1.21.3-8.el10_0
  • krb5 Rocky Linux 8 1.18.2-32.el8_10

rocky linux advisories RLSA-2025:9430RLSA-2025:9418RLSA-2025:8411

  • krb5 CBL-Mariner 2.0 1.19.4-4

azure linux advisories AZL-60928

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2025-3576 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-3576 updated cvss 5.9

krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions

  • Red Hat Enterprise Linux 6 krb5, libkadm5, krb5-libs, krb5-server, krb5-server-ldap, krb5-workstation, +1 more Red Hat Enterprise Linux 7 krb5, libkadm5, krb5-libs, krb5-pkinit, krb5-server, krb5-server-ldap, +1 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Discovery 2 discovery 2.0.0-1752592913
    fixed: vendor fix RHSA-2025:11487
  • Red Hat Enterprise Linux AppStream (v. 9) krb5-devel 1.21.1-8.el9_6, krb5-debuginfo 1.21.1-8.el9_6, krb5-debugsource 1.21.1-8.el9_6, libkadm5-debuginfo 1.21.1-8.el9_6, krb5-libs-debuginfo 1.21.1-8.el9_6, krb5-pkinit-debuginfo 1.21.1-8.el9_6, +3 more
    fixed: vendor fix RHSA-2025:9430
  • Red Hat Enterprise Linux AppStream (v. 10) krb5-devel 1.21.3-8.el10_0, krb5-debuginfo 1.21.3-8.el10_0, krb5-debugsource 1.21.3-8.el10_0, libkadm5-debuginfo 1.21.3-8.el10_0, krb5-libs-debuginfo 1.21.3-8.el10_0, krb5-pkinit-debuginfo 1.21.3-8.el10_0, +3 more
    fixed: vendor fix RHSA-2025:9418
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) krb5-devel 1.19.1-16.el9_0.4, krb5-debuginfo 1.19.1-16.el9_0.4, krb5-debugsource 1.19.1-16.el9_0.4, libkadm5-debuginfo 1.19.1-16.el9_0.4, krb5-libs-debuginfo 1.19.1-16.el9_0.4, krb5-pkinit-debuginfo 1.19.1-16.el9_0.4, +3 more
    fixed: vendor fix RHSA-2025:15000
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) krb5-devel 1.20.1-9.el9_2.3
    fixed: vendor fix RHSA-2025:13777
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) krb5-devel 1.21.1-2.el9_4.2, krb5-debuginfo 1.21.1-2.el9_4.2, krb5-debugsource 1.21.1-2.el9_4.2, libkadm5-debuginfo 1.21.1-2.el9_4.2, krb5-libs-debuginfo 1.21.1-2.el9_4.2, krb5-pkinit-debuginfo 1.21.1-2.el9_4.2, +3 more
    fixed: vendor fix RHSA-2025:13664
show 14 more
  • Red Hat Enterprise Linux BaseOS (v. 8) krb5 1.18.2-32.el8_10, libkadm5 1.18.2-32.el8_10, krb5-libs 1.18.2-32.el8_10, krb5-pkinit 1.18.2-32.el8_10, krb5-server 1.18.2-32.el8_10, krb5-server-ldap 1.18.2-32.el8_10, +1 more
    fixed: vendor fix RHSA-2025:8411
  • Red Hat Enterprise Linux BaseOS (v. 9) krb5 1.21.1-8.el9_6, libkadm5 1.21.1-8.el9_6, krb5-libs 1.21.1-8.el9_6, krb5-pkinit 1.21.1-8.el9_6, krb5-server 1.21.1-8.el9_6, krb5-server-ldap 1.21.1-8.el9_6, +1 more
    fixed: vendor fix RHSA-2025:9430
  • Red Hat Enterprise Linux BaseOS (v. 10) krb5 1.21.3-8.el10_0, libkadm5 1.21.3-8.el10_0, krb5-libs 1.21.3-8.el10_0, krb5-pkinit 1.21.3-8.el10_0, krb5-server 1.21.3-8.el10_0, krb5-server-ldap 1.21.3-8.el10_0, +1 more
    fixed: vendor fix RHSA-2025:9418
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) krb5 1.17-19.el8_2.3, libkadm5 1.17-19.el8_2.3, krb5-libs 1.17-19.el8_2.3, krb5-pkinit 1.17-19.el8_2.3, krb5-server 1.17-19.el8_2.3, krb5-server-ldap 1.17-19.el8_2.3, +1 more
    fixed: vendor fix RHSA-2025:15002
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) krb5 1.18.2-9.el8_4.3, libkadm5 1.18.2-9.el8_4.3, krb5-libs 1.18.2-9.el8_4.3, krb5-pkinit 1.18.2-9.el8_4.3, krb5-server 1.18.2-9.el8_4.3, krb5-server-ldap 1.18.2-9.el8_4.3, +1 more
    fixed: vendor fix RHSA-2025:15003
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) krb5 1.18.2-16.el8_6.4, libkadm5 1.18.2-16.el8_6.4, krb5-libs 1.18.2-16.el8_6.4, krb5-pkinit 1.18.2-16.el8_6.4, krb5-server 1.18.2-16.el8_6.4, krb5-server-ldap 1.18.2-16.el8_6.4, +1 more Red Hat Enterprise Linux BaseOS E4S (v.8.6) krb5 1.18.2-16.el8_6.4, libkadm5 1.18.2-16.el8_6.4, krb5-libs 1.18.2-16.el8_6.4, krb5-pkinit 1.18.2-16.el8_6.4, krb5-server 1.18.2-16.el8_6.4, krb5-server-ldap 1.18.2-16.el8_6.4, +1 more
    fixed: vendor fix RHSA-2025:15001
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) krb5 1.18.2-26.el8_8.5, libkadm5 1.18.2-26.el8_8.5, krb5-libs 1.18.2-26.el8_8.5, krb5-pkinit 1.18.2-26.el8_8.5, krb5-server 1.18.2-26.el8_8.5, krb5-server-ldap 1.18.2-26.el8_8.5, +1 more
    fixed: vendor fix RHSA-2025:15004
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) krb5 1.19.1-16.el9_0.4, libkadm5 1.19.1-16.el9_0.4, krb5-libs 1.19.1-16.el9_0.4, krb5-pkinit 1.19.1-16.el9_0.4, krb5-server 1.19.1-16.el9_0.4, krb5-server-ldap 1.19.1-16.el9_0.4, +1 more
    fixed: vendor fix RHSA-2025:15000
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) krb5 1.20.1-9.el9_2.3, libkadm5 1.20.1-9.el9_2.3, krb5-libs 1.20.1-9.el9_2.3, krb5-pkinit 1.20.1-9.el9_2.3, krb5-server 1.20.1-9.el9_2.3, krb5-server-ldap 1.20.1-9.el9_2.3, +1 more
    fixed: vendor fix RHSA-2025:13777
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) krb5 1.21.1-2.el9_4.2, libkadm5 1.21.1-2.el9_4.2, krb5-libs 1.21.1-2.el9_4.2, krb5-pkinit 1.21.1-2.el9_4.2, krb5-server 1.21.1-2.el9_4.2, krb5-server-ldap 1.21.1-2.el9_4.2, +1 more
    fixed: vendor fix RHSA-2025:13664
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) krb5 1.18.2-9.el8_4.3, libkadm5 1.18.2-9.el8_4.3, krb5-libs 1.18.2-9.el8_4.3, krb5-pkinit 1.18.2-9.el8_4.3, krb5-server 1.18.2-9.el8_4.3, krb5-server-ldap 1.18.2-9.el8_4.3, +1 more
    fixed: vendor fix RHSA-2025:15003
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) krb5 1.18.2-16.el8_6.4, libkadm5 1.18.2-16.el8_6.4, krb5-libs 1.18.2-16.el8_6.4, krb5-pkinit 1.18.2-16.el8_6.4, krb5-server 1.18.2-16.el8_6.4, krb5-server-ldap 1.18.2-16.el8_6.4, +1 more
    fixed: vendor fix RHSA-2025:15001
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) krb5 1.18.2-26.el8_8.5, libkadm5 1.18.2-26.el8_8.5, krb5-libs 1.18.2-26.el8_8.5, krb5-pkinit 1.18.2-26.el8_8.5, krb5-server 1.18.2-26.el8_8.5, krb5-server-ldap 1.18.2-26.el8_8.5, +1 more
    fixed: vendor fix RHSA-2025:15004
  • Red Hat Discovery 2 discovery 2.0.0-1752593703
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-134-16 updated cvss 5.9

Siemens Ruggedcom Rox

  • Siemens RUGGEDCOM ROX MX5000 < 2.17.1 Siemens RUGGEDCOM ROX MX5000RE < 2.17.1 Siemens RUGGEDCOM ROX RX1400 < 2.17.1 Siemens RUGGEDCOM ROX RX1500 < 2.17.1 Siemens RUGGEDCOM ROX RX1501 < 2.17.1 Siemens RUGGEDCOM ROX RX1510 < 2.17.1
    +5 more products
    Siemens RUGGEDCOM ROX RX1511 < 2.17.1 Siemens RUGGEDCOM ROX RX1512 < 2.17.1 Siemens RUGGEDCOM ROX RX1524 < 2.17.1 Siemens RUGGEDCOM ROX RX1536 < 2.17.1 Siemens RUGGEDCOM ROX RX5000 < 2.17.1
    affected: fixed in V2.17.1 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

  • web.mit.edu krb5
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift Container Platform 4
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.