CVE-2026-112321

Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths

7.5 HighFix available

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

What each source reports

CVE List Score used 7.5

Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths

Record: CVE-2026-112321
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-772
Updated: 2026-11-09

EUVDEUVD-2026-120237 7.5

Record: EUVD-2026-120237
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-09

GitHub AdvisoriesGHSA-7m7r-w6g3-6pph 7.5

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free...

Record: GHSA-7m7r-w6g3-6pph
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-772
Updated: 2026-11-09

NVD 7.5

Record: CVE-2026-112321
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-772
Updated: 2026-11-10

OSVALPINE-CVE-2026-112321 7.5

Record: ALPINE-CVE-2026-112321
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-10

OSVDEBIAN-CVE-2026-112321 7.5

Record: DEBIAN-CVE-2026-112321
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-10

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`krb5` Alpine:v3.24	before 1.22.3-r0	1.22.3-r0
`krb5` Debian:12	All versions, plus listed versions 1.20.1-21.20.1-2+deb12u11.20.1-2+deb12u21.20.1-2+deb12u31.20.1-2+deb12u4 Show 18 moreShow less 1.20.1-2+deb12u51.20.1-2+loong641.20.1-31.20.1-41.20.1-51.20.1-5.11.20.1-5.1~exp11.20.1-61.21.2-11.21.3-11.21.3-21.21.3-31.21.3-41.21.3-51.22.1-11.22.1-21.22.1-2.11.22.1-3	None known
`krb5` Debian:13	All versions, plus listed versions 1.21.3-51.21.3-5+deb13u11.22.1-11.22.1-21.22.1-2.11.22.1-3	None known
`krb5` Debian:14	All versions, plus listed versions 1.21.3-51.22.1-11.22.1-21.22.1-2.11.22.1-3	None known

History

History
Recorded	Changed	Sources
Nov 10, 2026	affected, aliases, facts, references	NVD, OSV
Nov 9, 2026	published	EUVD
Nov 9, 2026	affected, aliases, references	OSV
Nov 9, 2026	published	EUVD, NVD
Nov 9, 2026	aliases, references	GitHub Advisories
Nov 9, 2026	cwes, products, references, severity, title	CVE List
Nov 9, 2026	first indexed	EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-112321 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published November 9, 2026. No source lists public exploit code. Fixed in krb5 1.22.3-r0.