On certain error conditions, prep_reprocess_req() calls kdc_err() with a null pointer as the format string, causing a null dereference and denial of service. Legitimate protocol requests can trigger this problem. https://github.com/krb5/krb5/commit/289555f989b42f2b8d13efe4904dc3515433d5e5 Commit By: tlyu Revision: 23533 Changed Files: U trunk/src/kdc/do_tgs_req.c U trunk/src/lib/kadm5/logger.c