CVE-2006-5989: Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial...

Security readout for executives and security teams

CVE-2006-5989 is an old denial-of-service flaw in mod_auth_kerb 5.0. A malformed Kerberos message can crash the service by triggering a heap buffer overflow. The business impact is service availability, especially for Apache applications relying on Kerberos authentication. Exposure is likely limited to systems running Apache with mod_auth_kerb 5.0 or vendor packages derived from it. Internet-facing Kerberos-protected routes have higher availability risk. The bundle does not prove exposure for other products or versions. Address during legacy web-server remediation, with faster action for public or business-critical Kerberos-authenticated applications. This is not currently evidenced as actively exploited, but it can disrupt authentication-backed services. Mitigation focus: Inventory Apache servers using mod_auth_kerb and identify version 5.0 deployments.; Review Red Hat, Debian, Gentoo, Mandriva, and local vendor advisories for fixed packages.; Apply vendor-supported updates where affected packages are found..

Prepared

Jun 29, 2026, 09:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.