CVE-2026-112323
HighCVSS 7.5Summary
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
Risk Assessment
An attacker can exhaust memory in kadmind, causing a crash or unavailability of the Kerberos administration service. This can prevent management of the Kerberos database and affect service availability.
Recommendation
Update MIT Kerberos 5 to a version containing the fix if available. Consider restricting kadmind access from untrusted networks and monitoring memory usage.
Other vulnerabilities in MIT Kerberos 5
See all- CVE-2026-119079High
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
- CVE-2026-112322High
In MIT Kerberos 5, clean_client() in lib/rpc/svc_auth_gssapi.c restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
- CVE-2026-112321High
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 does not free decoded arguments on certain error paths. Remote attackers can cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
- CVE-2026-112320High
The GSS-RPC transport layer in MIT Kerberos 5 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. Remote attackers can cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
- CVE-2026-112319Medium
The GSS-RPC layer in MIT Kerberos 5 (krb5) does not enforce size limits on XDR-decoded data. Remote authenticated users can send crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
- CVE-2026-112318Medium
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(). Remote authenticated users can send a policy request with an empty policy name that reaches authorization checks or logging code.
- CVE-2026-112317Medium
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails. Remote attackers can repeatedly trigger key decryption failures.
- CVE-2026-112316Medium
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (krb5) does not free partially decoded data on failure. Remote authenticated users can send crafted RPC requests that trigger a decode failure.
- CVE-2026-112315Medium
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (krb5) 1.4 and later do not free partially decoded buffers on failure. Remote attackers can send crafted RPCSEC_GSS messages.
- CVE-2026-112314High
clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 does not free the RPC reply verifier between retries. Remote attackers can cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
Original NVD description (English source)
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS