Vulnerability-Lookup

OESA-2026-1348 (CVE-2026-25506)

Vulnerability from osv_openeuler – Published: 2026-02-13 11:10 – Updated: 2026-08-06 11:10 – Source website

Summary

munge security update

Details

MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.

Security Fix(es):

MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18.(CVE-2026-25506)

Severity

7.7 (High)


                    
                      CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-25506	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "munge-0.5.14-2.oe2003sp4.aarch64.rpm",
          "munge-debuginfo-0.5.14-2.oe2003sp4.aarch64.rpm",
          "munge-debugsource-0.5.14-2.oe2003sp4.aarch64.rpm",
          "munge-devel-0.5.14-2.oe2003sp4.aarch64.rpm",
          "munge-libs-0.5.14-2.oe2003sp4.aarch64.rpm"
        ],
        "src": [
          "munge-0.5.14-2.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "munge-0.5.14-2.oe2003sp4.x86_64.rpm",
          "munge-debuginfo-0.5.14-2.oe2003sp4.x86_64.rpm",
          "munge-debugsource-0.5.14-2.oe2003sp4.x86_64.rpm",
          "munge-devel-0.5.14-2.oe2003sp4.x86_64.rpm",
          "munge-libs-0.5.14-2.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "munge",
        "purl": "pkg:rpm/openEuler/munge\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.14-2.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "munge-0.5.14-2.oe2203sp4.aarch64.rpm",
          "munge-debuginfo-0.5.14-2.oe2203sp4.aarch64.rpm",
          "munge-debugsource-0.5.14-2.oe2203sp4.aarch64.rpm",
          "munge-devel-0.5.14-2.oe2203sp4.aarch64.rpm",
          "munge-libs-0.5.14-2.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "munge-0.5.14-2.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "munge-0.5.14-2.oe2203sp4.x86_64.rpm",
          "munge-debuginfo-0.5.14-2.oe2203sp4.x86_64.rpm",
          "munge-debugsource-0.5.14-2.oe2203sp4.x86_64.rpm",
          "munge-devel-0.5.14-2.oe2203sp4.x86_64.rpm",
          "munge-libs-0.5.14-2.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "munge",
        "purl": "pkg:rpm/openEuler/munge\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.14-2.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "munge-0.5.15-2.oe2403.aarch64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403.aarch64.rpm",
          "munge-debugsource-0.5.15-2.oe2403.aarch64.rpm",
          "munge-devel-0.5.15-2.oe2403.aarch64.rpm",
          "munge-libs-0.5.15-2.oe2403.aarch64.rpm",
          "munge-0.5.15-2.oe2403sp1.aarch64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp1.aarch64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp1.aarch64.rpm",
          "munge-devel-0.5.15-2.oe2403sp1.aarch64.rpm",
          "munge-libs-0.5.15-2.oe2403sp1.aarch64.rpm",
          "munge-0.5.15-2.oe2403sp2.aarch64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp2.aarch64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp2.aarch64.rpm",
          "munge-devel-0.5.15-2.oe2403sp2.aarch64.rpm",
          "munge-libs-0.5.15-2.oe2403sp2.aarch64.rpm",
          "munge-0.5.15-2.oe2403sp3.aarch64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp3.aarch64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp3.aarch64.rpm",
          "munge-devel-0.5.15-2.oe2403sp3.aarch64.rpm",
          "munge-libs-0.5.15-2.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "munge-0.5.15-2.oe2403.src.rpm",
          "munge-0.5.15-2.oe2403sp1.src.rpm",
          "munge-0.5.15-2.oe2403sp2.src.rpm",
          "munge-0.5.15-2.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "munge-0.5.15-2.oe2403.x86_64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403.x86_64.rpm",
          "munge-debugsource-0.5.15-2.oe2403.x86_64.rpm",
          "munge-devel-0.5.15-2.oe2403.x86_64.rpm",
          "munge-libs-0.5.15-2.oe2403.x86_64.rpm",
          "munge-0.5.15-2.oe2403sp1.x86_64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp1.x86_64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp1.x86_64.rpm",
          "munge-devel-0.5.15-2.oe2403sp1.x86_64.rpm",
          "munge-libs-0.5.15-2.oe2403sp1.x86_64.rpm",
          "munge-0.5.15-2.oe2403sp2.x86_64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp2.x86_64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp2.x86_64.rpm",
          "munge-devel-0.5.15-2.oe2403sp2.x86_64.rpm",
          "munge-libs-0.5.15-2.oe2403sp2.x86_64.rpm",
          "munge-0.5.15-2.oe2403sp3.x86_64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp3.x86_64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp3.x86_64.rpm",
          "munge-devel-0.5.15-2.oe2403sp3.x86_64.rpm",
          "munge-libs-0.5.15-2.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "munge",
        "purl": "pkg:rpm/openEuler/munge\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.15-2.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "munge-0.5.15-2.oe2403sp1.aarch64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp1.aarch64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp1.aarch64.rpm",
          "munge-devel-0.5.15-2.oe2403sp1.aarch64.rpm",
          "munge-libs-0.5.15-2.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "munge-0.5.15-2.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "munge-0.5.15-2.oe2403sp1.x86_64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp1.x86_64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp1.x86_64.rpm",
          "munge-devel-0.5.15-2.oe2403sp1.x86_64.rpm",
          "munge-libs-0.5.15-2.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "munge",
        "purl": "pkg:rpm/openEuler/munge\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.15-2.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "munge-0.5.15-2.oe2403sp2.aarch64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp2.aarch64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp2.aarch64.rpm",
          "munge-devel-0.5.15-2.oe2403sp2.aarch64.rpm",
          "munge-libs-0.5.15-2.oe2403sp2.aarch64.rpm"
        ],
        "src": [
          "munge-0.5.15-2.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "munge-0.5.15-2.oe2403sp2.x86_64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp2.x86_64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp2.x86_64.rpm",
          "munge-devel-0.5.15-2.oe2403sp2.x86_64.rpm",
          "munge-libs-0.5.15-2.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "munge",
        "purl": "pkg:rpm/openEuler/munge\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.15-2.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "munge-0.5.15-2.oe2403sp3.aarch64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp3.aarch64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp3.aarch64.rpm",
          "munge-devel-0.5.15-2.oe2403sp3.aarch64.rpm",
          "munge-libs-0.5.15-2.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "munge-0.5.15-2.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "munge-0.5.15-2.oe2403sp3.x86_64.rpm",
          "munge-debuginfo-0.5.15-2.oe2403sp3.x86_64.rpm",
          "munge-debugsource-0.5.15-2.oe2403sp3.x86_64.rpm",
          "munge-devel-0.5.15-2.oe2403sp3.x86_64.rpm",
          "munge-libs-0.5.15-2.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "munge",
        "purl": "pkg:rpm/openEuler/munge\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.15-2.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "MUNGE (MUNGE Uid \u0026amp;apos;N\u0026amp;apos; Gid Emporium) is an authentication service for creating\nand validating credentials. It is designed to be highly scalable for use\nin an HPC cluster environment.\nIt allows a process to authenticate the UID and GID of another local or\nremote process within a group of hosts having common users and groups.\nThese hosts form a security realm that is defined by a shared cryptographic\nkey. Clients within this security realm can create and validate credentials\nwithout the use of root privileges, reserved ports, or platform-specific\nmethods.\r\n\r\nSecurity Fix(es):\n\nMUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged\u0026apos;s internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18.(CVE-2026-25506)",
  "id": "OESA-2026-1348",
  "modified": "2026-08-06T11:10:22Z",
  "published": "2026-02-13T11:10:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1348"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25506"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "munge security update",
  "upstream": [
    "CVE-2026-25506"
  ]
}

CVE-2026-25506 (GCVE-0-2026-25506)

Vulnerability from cvelistv5 – Published: 2026-02-10 18:55 – Updated: 2026-07-15 01:16

Title

MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery

Summary

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-10 19:12 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

GitHub_M mitre root

References

22 references

URL	Tags
https://github.com/dun/munge/security/advisories/…	x_refsource_CONFIRM
https://github.com/dun/munge/commit/bf40cc27c4ce8…	x_refsource_MISC
https://github.com/dun/munge/releases/tag/munge-0.5.18	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/02/10/3
https://lists.debian.org/debian-lts-announce/2026…
http://www.openwall.com/lists/oss-security/2026/02/17/6
https://access.redhat.com/security/cve/CVE-2026-25506	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2438715	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:2954	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3033	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3032	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3011	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3010	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3013	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3012	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2949	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2934	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2923	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2918	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3034	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16174	vendor-advisoryx_refsource_REDHAT

Impacted products

18 products

Vendor	Product	Version
dun	munge	Affected: >= 0.5, < 0.5.18
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.5.15-11.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:0.5.15-10.el10_0.1 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.5.13-3.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:0.5.13-1.el8_2.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:0.5.13-2.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:0.5.13-2.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:0.5.13-2.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:0.5.13-2.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:0.5.13-2.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:0.5.13-2.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:0.5.13-2.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.5.13-14.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:0.5.13-13.el9_0.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:0.5.13-13.el9_2.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:0.5.13-13.el9_4.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:0.5.13-13.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244546 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T19:12:47.174130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T19:13:33.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-17T18:17:47.022Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/02/10/3"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00015.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/02/17/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.15-11.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.15-10.el10_0.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-3.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.2"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-1.el8_2.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-2.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-2.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-2.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-2.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-2.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-2.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-2.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-14.el9_7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-13.el9_0.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-13.el9_2.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-13.el9_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "munge",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.5.13-13.el9_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-spyre-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244546",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "datePublic": "2026-02-10T18:55:57.708Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A buffer overflow vulnerability was discovered in the MUNGE authentication daemon (munged). In affected versions, a local attacker can potentially leak secret cryptographic key material from the daemon\u0027s memory by sending a specially crafted message with an oversized address field. With the leaked key, an attacker could forge authentication credentials to impersonate any user, potentially escalating privileges in systems that rely on MUNGE for identity verification."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 7.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:16:25.482Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-25506"
          },
          {
            "name": "RHBZ#2438715",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438715"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25506.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:2954"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3033"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3032"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3011"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3013"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3012"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:2949"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:2934"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:2923"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:2918"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3034"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16174"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:2954: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3033: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3032: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3011: Red Hat Enterprise Linux AppStream AUS (v. 8.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3010: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3013: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3012: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:2949: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:2934: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:2923: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:2918: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3034: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16174: Red Hat AI Inference Server 3.3"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-02-10T20:02:45.975Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-02-10T18:55:57.708Z",
            "value": "Made public."
          }
        ],
        "title": "MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "munge",
          "vendor": "dun",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.5, \u003c 0.5.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged\u0027s internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-10T18:55:57.708Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh"
        },
        {
          "name": "https://github.com/dun/munge/commit/bf40cc27c4ce8451d4b062c9de0b67ec40894812",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dun/munge/commit/bf40cc27c4ce8451d4b062c9de0b67ec40894812"
        },
        {
          "name": "https://github.com/dun/munge/releases/tag/munge-0.5.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dun/munge/releases/tag/munge-0.5.18"
        }
      ],
      "source": {
        "advisory": "GHSA-r9cr-jf4v-75gh",
        "discovery": "UNKNOWN"
      },
      "title": "MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25506",
    "datePublished": "2026-02-10T18:55:57.708Z",
    "dateReserved": "2026-02-02T18:21:42.486Z",
    "dateUpdated": "2026-07-15T01:16:25.482Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.