CVE-2026-112320
HighCVSS 7.5Summary
The GSS-RPC transport layer in MIT Kerberos 5 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. Remote attackers can cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
Risk Assessment
An attacker can exhaust kadmind memory and crash it, blocking Kerberos authentication services. The issue affects many versions and can be exploited remotely without authentication.
Recommendation
Update MIT Kerberos to a version containing the fix. Restrict access to RPC/kadmind services from untrusted networks.
Other vulnerabilities in MIT Kerberos 5
See all- CVE-2026-119079High
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
- CVE-2026-112323High
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
- CVE-2026-112322High
In MIT Kerberos 5, clean_client() in lib/rpc/svc_auth_gssapi.c restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
- CVE-2026-112321High
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 does not free decoded arguments on certain error paths. Remote attackers can cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
- CVE-2026-112319Medium
The GSS-RPC layer in MIT Kerberos 5 (krb5) does not enforce size limits on XDR-decoded data. Remote authenticated users can send crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
- CVE-2026-112318Medium
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(). Remote authenticated users can send a policy request with an empty policy name that reaches authorization checks or logging code.
- CVE-2026-112317Medium
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails. Remote attackers can repeatedly trigger key decryption failures.
- CVE-2026-112316Medium
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (krb5) does not free partially decoded data on failure. Remote authenticated users can send crafted RPC requests that trigger a decode failure.
- CVE-2026-112315Medium
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (krb5) 1.4 and later do not free partially decoded buffers on failure. Remote attackers can send crafted RPCSEC_GSS messages.
- CVE-2026-112314High
clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 does not free the RPC reply verifier between retries. Remote attackers can cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
Original NVD description (English source)
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS