CVE-2025-3576

Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions

State: Published
Severity: 5.9 Medium
Published: Apr 15, 2025
Updated: Sep 1, 2026
Reserved: Apr 14, 2025

Description

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	redhat

Weaknesses

CWE-328 Use of Weak Hash

Affected Products

Product	Versions
krb5	before 1.22Affected
Red Hat Enterprise Linux 10Red Hat	0:1.21.3-8.el10_0 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:1.18.2-32.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat	0:1.17-19.el8_2.3 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:1.18.2-9.el8_4.3 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat	0:1.18.2-9.el8_4.3 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:1.18.2-16.el8_6.4 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat	0:1.18.2-16.el8_6.4 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat	0:1.18.2-16.el8_6.4 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:1.18.2-26.el8_8.5 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:1.18.2-26.el8_8.5 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.21.1-8.el9_6 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.21.1-8.el9_6 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat	0:1.19.1-16.el9_0.4 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	0:1.20.1-9.el9_2.3 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat	0:1.21.1-2.el9_4.2 and laterNot affected
Red Hat Discovery 2Red Hat	2.0.0-1752592913 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat

References

RHSA-2025:11487vendor-advisory
RHSA-2025:13664vendor-advisory
RHSA-2025:13777vendor-advisory
RHSA-2025:15000vendor-advisory
RHSA-2025:15001vendor-advisory
RHSA-2025:15002vendor-advisory
RHSA-2025:15003vendor-advisory
RHSA-2025:15004vendor-advisory
RHSA-2025:8411vendor-advisory
RHSA-2025:9418vendor-advisory
RHSA-2025:9430vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-3576vdb-entry
RHBZ#2359465issue-tracking
https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00047.html
https://cert-portal.siemens.com/productcert/html/ssa-577017.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.