SSRF in Latchset Kdcproxy
CVE-2025-59088
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (37.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Latchset Kdcproxy — versions 0
- Red Hat Enterprise Linux 10 — versions 0:1.0.0-19.el10_1
- Red Hat Enterprise Linux 10.0 Extended Update Support — versions 0:1.0.0-19.el10_0
- Red Hat Enterprise Linux 7 Extended Lifecycle Support — versions 0:0.3.2-3.el7_9.3
- Red Hat Enterprise Linux 8 — versions 8100020251103113748.143e9e98, 8100020251028161822.823393f5
- Red Hat Enterprise Linux 8.2 Advanced Update Support — versions 8020020251106022345.792f4060
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — versions 8040020251103205102.5b01ab7e
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On — versions 8040020251103205102.5b01ab7e
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support — versions 8060020251030180424.ada582f1
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service — versions 8060020251030180424.ada582f1
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2025:21138 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21139 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21140 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21141 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21142 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21448 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21748 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21806 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21818 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21819 (vendor-advisory)
Frequently asked questions
- What is CVE-2025-59088?
- CVE-2025-59088 is a high-severity vulnerability in Latchset Kdcproxy, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.6/10. Published 2025-11-12.
- How severe is CVE-2025-59088?
- High severity. CVSS v3 base score is 8.6 out of 10.