Denial-of-Service Vulnerability in KDCProxy Affects Red Hat Products

CVE-2025-59089

What is CVE-2025-59089?

An attacker can exploit a vulnerability in KDCProxy by manipulating the connection to an attacker-controlled KDC server. This occurs through server-side request forgery, enabling the attacker to bypass length restrictions on TCP responses. KDCProxy fails to enforce limits on the size of incoming data, leading to excessive memory consumption and CPU usage. The attack can overwhelm server resources, creating conditions that deny service to legitimate users through response buffer overflow and prolonged connection timeouts.

References