---
id: CVE-2025-59088
title: >-
  If kdcproxy receives a request for a realm which does not have server
  addresses defined in its configuration, by default, it will query SRV records
  in the DNS zone matching the requested realm name
summary: >-
  If kdcproxy receives a request for a realm which does not have server
  addresses defined in its configuration, by default, it will query SRV records
  in the DNS zone matching the requested realm name. This creates a server-side
  request for…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
published: '2025-11-12'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59088'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:21138'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21139'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21140'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21141'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21142'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21448'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21748'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21806'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21818'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21819'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21820'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21821'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22982'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-59088'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2393955'
    label: secalert@redhat.com
  - url: 'https://github.com/latchset/kdcproxy/pull/68'
    label: secalert@redhat.com
tags:
  - nvd
epss: 0.00458
epssPercentile: 0.37167
ingestedAt: '2026-06-29T13:24:34.598Z'
---

## Overview

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where
the "use_dns" setting is explicitly set to false are not affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.