Database/Control plane, storage & DevOps

Grid Community Toolkit globus-gss-assist: pre-auth heap out-of-bounds write via short SSLv2 GSI record

CVSS 8.7CVE-2026-123975Control plane, storage & DevOpscurated

Impact

A crafted GSI handshake record with an SSLv2 record length below 3 makes globus_gss_assist_token_get_fd() write past a heap buffer before any authentication completes. The record states the result as heap corruption and a service crash, so the demonstrated effect is denial of service of grid entry points such as globus-gatekeeper and myproxy. On an HPC or grid site those services are the front door for job submission and credential delegation, so crashing them stops remote users from submitting work to the cluster or renewing proxy credentials. The record does not claim code execution, but heap corruption reachable without authentication should be treated as more than a crash until shown otherwise.

Who can reach it

Any network client that can reach a GSI-speaking service (globus-gatekeeper, myproxy and others built on globus-gss-assist). No authentication needed, since the flaw is in the handshake itself.

What to do

Upgrade to Grid Community Toolkit 6.2.20261111 (globus-gss-assist 12.9) or later, then restart every daemon linked against the library (gatekeeper, myproxy-server and any other GSI services). Compute nodes do not need a drain unless they run these services. Until patched, limit who can reach the GSI ports to known client networks.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-123975 https://github.com/gridcf/gct/commit/3df2be4834c146bdcec90009a0f2e5771ff63cca https://github.com/gridcf/gct/releases/tag/v6.2.20261111 https://www.vulncheck.com/advisories/grid-community-toolkit-globus-gss-assist-before-12.9-pre-authentication-heap-out-of-bounds-write

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.