{"id":"AZL-107957","summary":"CVE-2026-91926 affecting package gssntlmssp 1.3.1-1","details":"A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.","modified":"2026-10-16T05:57:31Z","published":"2026-09-15T12:17:54Z","upstream":["CVE-2026-91926"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91926"}],"affected":[{"package":{"name":"gssntlmssp","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/gssntlmssp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107957.json"}}],"schema_version":"1.9.0"}