CVE-2024-37371: debian debian_linux Out-of-bounds Read
CVSS: 9.1v3.1CriticalModified
AliasesALPINE-CVE-2024-37371UBUNTU-CVE-2024-37371DEBIAN-CVE-2024-37371
Published 28-06-2024Last modified 15-10-2026
Vulnerability summary
CVE-2024-37371 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 1.86% chance of exploitation in the next 30 days, higher than 78.9% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)EPSS score
1.86%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 23 · Related 9DSA-5726-1MGASA-2024-0253OPENSUSE-SU-2024:14111-1RHSA-2024:4734RHSA-2024:4743RHSA-2024:5076RHSA-2024:5312RHSA-2024:5316RHSA-2024:5625RHSA-2024:5630RHSA-2024:5643RHSA-2024:5884RHSA-2024:6166RHSA-2025:1671RHSA-2025:1673SUSE-SU-2024:2300-1SUSE-SU-2024:2302-1SUSE-SU-2024:2303-1SUSE-SU-2024:2305-1SUSE-SU-2024:2307-1SUSE-SU-2024:2322-1SUSE-SU-2025:20051-1USN-6947-1
Timeline
- 28-06-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.
CVSS metrics
5 scores · 5 sources · 1 versionCritical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
1.86%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.86% on 18-09-2026
18-09-202618-10-2026
EPSS score1.86%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- krb5< 1.20.1-2+deb12u2 | < 1.21.3-1
- debian_linuxEOL11.0 | 12.0
Alpine1 product
- krb5< 1.20.2-r1 | < 1.20.3-r0
Mit1 product
- kerberos_5< 1.21.3
Ubuntu1 product
- krb5< 1.12+dfsg-2ubuntu5.4+esm5 | < 1.13.2+dfsg-5ubuntu2.2+esm5 | < 1.16-2ubuntu0.4+esm2 | < 1.17-6ubuntu4.6 | < 1.19.2-2ubuntu0.4 | < 1.20.1-6ubuntu2.1
4 vendors · 5 products
