CVE-2026-112322
Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
CVE List Score used
Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
- Record
CVE-2026-112322- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-09
EUVDEUVD-2026-120224
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
- Record
EUVD-2026-120224- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-09
GitHub AdvisoriesGHSA-67w6-q7fj-jmqf
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from...
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
- Record
GHSA-67w6-q7fj-jmqf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-09
NVD
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
- Record
CVE-2026-112322- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-10
OSVALPINE-CVE-2026-112322
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
- Record
ALPINE-CVE-2026-112322- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
OSVDEBIAN-CVE-2026-112322
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
- Record
DEBIAN-CVE-2026-112322- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Alpine:v3.24 |
before 1.22.3-r0 | 1.22.3-r0 |
krb5Debian:12 |
All versions, plus listed versions 1.20.1-21.20.1-2+deb12u11.20.1-2+deb12u21.20.1-2+deb12u31.20.1-2+deb12u4 Show 18 moreShow less1.20.1-2+deb12u51.20.1-2+loong641.20.1-31.20.1-41.20.1-51.20.1-5.11.20.1-5.1~exp11.20.1-61.21.2-11.21.3-11.21.3-21.21.3-31.21.3-41.21.3-51.22.1-11.22.1-21.22.1-2.11.22.1-3 |
None known |
krb5Debian:13 |
All versions, plus listed versions 1.21.3-51.21.3-5+deb13u11.22.1-11.22.1-21.22.1-2.11.22.1-3 |
None known |
krb5Debian:14 |
All versions, plus listed versions 1.21.3-51.22.1-11.22.1-21.22.1-2.11.22.1-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | NVD, OSV | |
| published | EUVD | |
| affected, aliases, references | OSV | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-112322 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published November 9, 2026. No source lists public exploit code. Fixed in krb5 1.22.3-r0.