An update for gssproxy is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4824 Final 1.0 1.0 2026-11-11 Initial 2026-11-11 2026-11-11 openEuler SA Tool V1.0 2026-11-11 gssproxy security update An update for gssproxy is now available for openEuler-24.03-LTS-SP4 This is a proxy for GSSAPI which deals with credential handling Security Fix(es): A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.(CVE-2026-116497) An update for gssproxy is now available for openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium gssproxy https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4824 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-116497 https://nvd.nist.gov/vuln/detail/CVE-2026-116497 openEuler-24.03-LTS-SP4 gssproxy-0.9.2-9.oe2403sp4.src.rpm gssproxy-0.9.2-9.oe2403sp4.x86_64.rpm gssproxy-debuginfo-0.9.2-9.oe2403sp4.x86_64.rpm gssproxy-debugsource-0.9.2-9.oe2403sp4.x86_64.rpm gssproxy-help-0.9.2-9.oe2403sp4.noarch.rpm gssproxy-0.9.2-9.oe2403sp4.aarch64.rpm gssproxy-debuginfo-0.9.2-9.oe2403sp4.aarch64.rpm gssproxy-debugsource-0.9.2-9.oe2403sp4.aarch64.rpm A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM. 2026-11-11 CVE-2026-116497 openEuler-24.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H gssproxy security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4824