Server-Side Request Forgery Vulnerability in Kdcproxy by Red Hat
CVE-2025-59088

8.6HIGH

Key Information:

Vendor: Latchset
Status: Kdcproxy; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support
Vendor: CVE Published:; 12 November 2025

What is CVE-2025-59088?

This vulnerability arises when Kdcproxy processes a request for a realm without defined server addresses, leading it to query SRV records in the DNS zone of the realm. A malicious actor can exploit this behavior by crafting specific requests that target a DNS zone where they control SRV records. This could direct queries to arbitrary ports and hostnames, including those that resolve to internal or loopback IP addresses. As a result, attackers can probe the internal network's topology, scan ports, and potentially exfiltrate sensitive data. Deployments where the 'use_dns' setting is disabled are immune to this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch