- CVE-2021-37750: check for a null server after decoding the FAST inner body in the KDC's TGS path. kdc_find_fast() can replace the request, and sprinc is reset from it; with no null check, get_local_tgt() then dereferenced sprinc->realm, so an authenticated client could crash krb5kdc with a FAST TGS request carrying no server field. Upstream d775c95a (1.18.5, 1.19.3) - CVE-2023-36054: ensure n_key_data matches the decoded key_data array count in _xdr_kadm5_principal_ent_rec(). The count was decoded unvalidated and xdr_array() was called with an unbounded limit and the decoded count never written back, so freeing the structure later could iterate the wrong number of elements and free uninitialized pointers, crashing kadmind. Reachable in both directions - a kadmind decoding a client request and a kadmin client decoding a malicious server's reply. Upstream ef08b09c (1.20.2, 1.21.1) - CVE-2026-107778: check for the end of the encrypted ticket-info list in make_cred_list(). The list is sized from krbcred->tickets but indexed into encpart->ticket_info with no bound of its own, so a KRB-CRED with more tickets than ticket_info entries dereferenced the NULL terminator. Reached through gss_accept_sec_context() when an acceptor processes forwarded credentials. Upstream 48afa9ab (after 1.22.2) - Reject a KrbCredInfo whose client or server principal name is absent, in make_cred_list(). Both names are optional in RFC 4120 and decode to NULL, and krb5_copy_principal() dereferences its input unconditionally, so a KRB-CRED omitting either crashed an acceptor on the same path. Upstream 5031b854a (ticket 9219) folds this into the CVE-2026-107778 guard; carried here as a separate patch. No CVE - CVE-2026-107708 is not applicable to 1.17: the vulnerable function get_pac_princ_with_realm() does not exist, nor does any PAC-parsing path in the KDC. It was introduced upstream by a441fbe32 (2022-01-12), three years after this release. 1.17's KDC identifies the S4U client from PA-FOR-USER via kdc_process_for_user(), and calls no krb5_pac_* function at all