CVE-2025-3576

MediumCVSS 5.9/10Last modified Sep 1, 2026

Description

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-328

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2025
Last modified
Sep 1, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-35774.9**UNSUPPORTED WHEN ASSIGNED** A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00CVE-2025-35789.3A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in tCVE-2025-35799.3In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute unauthorised commands wCVE-2025-35805.5An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server adminiCVE-2025-35814.8The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/CVE-2025-35824.8The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users CVE-2025-35834.8The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users suchCVE-2025-35844.8The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privileCVE-2025-35858.8A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the coCVE-2025-35867.2In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2CVE-2025-35878.8A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of theCVE-2025-35885.3A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function