CVE-2026-112320
Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
CVE List Score used
Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
- Record
CVE-2026-112320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-09
EUVDEUVD-2026-120236
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
- Record
EUVD-2026-120236- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-09
GitHub AdvisoriesGHSA-hjgq-cq7f-j633
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the...
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
- Record
GHSA-hjgq-cq7f-j633- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-09
NVD
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
- Record
CVE-2026-112320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-09
OSVALPINE-CVE-2026-112320
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
- Record
ALPINE-CVE-2026-112320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
OSVDEBIAN-CVE-2026-112320
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
- Record
DEBIAN-CVE-2026-112320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Alpine:v3.24 |
before 1.22.3-r0 | 1.22.3-r0 |
krb5Debian:12 |
All versions, plus listed versions 1.20.1-21.20.1-2+deb12u11.20.1-2+deb12u21.20.1-2+deb12u31.20.1-2+deb12u4 Show 18 moreShow less1.20.1-2+deb12u51.20.1-2+loong641.20.1-31.20.1-41.20.1-51.20.1-5.11.20.1-5.1~exp11.20.1-61.21.2-11.21.3-11.21.3-21.21.3-31.21.3-41.21.3-51.22.1-11.22.1-21.22.1-2.11.22.1-3 |
None known |
krb5Debian:13 |
All versions, plus listed versions 1.21.3-51.21.3-5+deb13u11.22.1-11.22.1-21.22.1-2.11.22.1-3 |
None known |
krb5Debian:14 |
All versions, plus listed versions 1.21.3-51.22.1-11.22.1-21.22.1-2.11.22.1-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| affected, aliases, references | OSV | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| cwes, products, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-112320 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published November 9, 2026. No source lists public exploit code. Fixed in krb5 1.22.3-r0.