CVE-2026-119079
HighCVSS 7.5Summary
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
Risk Assessment
An attacker can overload the KDC, causing high CPU usage and delays or unavailability of Kerberos authentication services. This can disrupt the entire infrastructure relying on Kerberos.
Recommendation
Update MIT Kerberos 5 to a version containing the fix if available. Consider restricting KDC access from untrusted networks and monitoring CPU load.
Other vulnerabilities in MIT Kerberos 5
See all- CVE-2026-112323High
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
- CVE-2026-112322High
In MIT Kerberos 5, clean_client() in lib/rpc/svc_auth_gssapi.c restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
- CVE-2026-112321High
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 does not free decoded arguments on certain error paths. Remote attackers can cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
- CVE-2026-112320High
The GSS-RPC transport layer in MIT Kerberos 5 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. Remote attackers can cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
- CVE-2026-112319Medium
The GSS-RPC layer in MIT Kerberos 5 (krb5) does not enforce size limits on XDR-decoded data. Remote authenticated users can send crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
- CVE-2026-112318Medium
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(). Remote authenticated users can send a policy request with an empty policy name that reaches authorization checks or logging code.
- CVE-2026-112317Medium
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails. Remote attackers can repeatedly trigger key decryption failures.
- CVE-2026-112316Medium
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (krb5) does not free partially decoded data on failure. Remote authenticated users can send crafted RPC requests that trigger a decode failure.
- CVE-2026-112315Medium
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (krb5) 1.4 and later do not free partially decoded buffers on failure. Remote attackers can send crafted RPCSEC_GSS messages.
- CVE-2026-112314High
clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 does not free the RPC reply verifier between retries. Remote attackers can cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
Original NVD description (English source)
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS