CVE-2026-112316

decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.

In MIT Kerberos 5, clean_client() in lib/rpc/svc_auth_gssapi.c restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 does not free decoded arguments on certain error paths. Remote attackers can cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.

The GSS-RPC transport layer in MIT Kerberos 5 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. Remote attackers can cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.

The GSS-RPC layer in MIT Kerberos 5 (krb5) does not enforce size limits on XDR-decoded data. Remote authenticated users can send crafted RPC requests that trigger unbounded memory allocations during XDR decoding.

The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(). Remote authenticated users can send a policy request with an empty policy name that reaches authorization checks or logging code.

krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails. Remote attackers can repeatedly trigger key decryption failures.

The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (krb5) 1.4 and later do not free partially decoded buffers on failure. Remote attackers can send crafted RPCSEC_GSS messages.

clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 does not free the RPC reply verifier between retries. Remote attackers can cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.