---
id: CVE-2024-37370
title: >-
  In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the
  plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the
  unwrapped token to appear truncated to the application.
summary: >-
  In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the
  plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the
  unwrapped token to appear truncated to the application.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: adp
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-07-01T15:25:49.407050Z'
published: '2024-06-28'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T00:43:15.744Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-37370'
references:
  - url: 'https://web.mit.edu/kerberos/www/advisories/'
  - url: >-
      https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
tags:
  - cve.org
epss: 0.00748
epssPercentile: 0.54698
ingestedAt: '2026-10-15T04:46:37.321Z'
---

## Overview

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.