{"id":"CVE-2026-112321","aliases":["ALPINE-CVE-2026-112321","BELL-CVE-2026-112321","DEBIAN-CVE-2026-112321","EUVD-2026-120237","GHSA-7m7r-w6g3-6pph","UBUNTU-CVE-2026-112321"],"status":"published","title":"Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.009,"percentile":0.60134,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2026-11-09T19:08:10Z","modified":"2026-11-13T00:32:44Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r2"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-2","1.20.1-2+deb12u1","1.20.1-2+deb12u2","1.20.1-2+deb12u3","1.20.1-2+deb12u4","1.20.1-2+deb12u5","1.20.1-2+loong64","1.20.1-3","1.20.1-4","1.20.1-5","1.20.1-5.1","1.20.1-5.1~exp1","1.20.1-6","1.21.2-1","1.21.3-1","1.21.3-2","1.21.3-3","1.21.3-4","1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.21.3-5+deb13u1","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1+dfsg-6.1ubuntu1","1.11.3+dfsg-3ubuntu2","1.12+dfsg-2ubuntu1","1.12+dfsg-2ubuntu2","1.12+dfsg-2ubuntu3","1.12+dfsg-2ubuntu4","1.12+dfsg-2ubuntu4.2","1.12+dfsg-2ubuntu5","1.12+dfsg-2ubuntu5.1","1.12+dfsg-2ubuntu5.2","1.12+dfsg-2ubuntu5.3","1.12+dfsg-2ubuntu5.4","1.12+dfsg-2ubuntu5.4+esm1","1.12+dfsg-2ubuntu5.4+esm2","1.12+dfsg-2ubuntu5.4+esm3","1.12+dfsg-2ubuntu5.4+esm4","1.12+dfsg-2ubuntu5.4+esm5","1.12+dfsg-2ubuntu5.4+esm6","1.12+dfsg-2ubuntu5.4+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-2","1.13.2+dfsg-3","1.13.2+dfsg-4","1.13.2+dfsg-5","1.13.2+dfsg-5ubuntu1","1.13.2+dfsg-5ubuntu2","1.13.2+dfsg-5ubuntu2.1","1.13.2+dfsg-5ubuntu2.1+esm1","1.13.2+dfsg-5ubuntu2.2","1.13.2+dfsg-5ubuntu2.2+esm1","1.13.2+dfsg-5ubuntu2.2+esm2","1.13.2+dfsg-5ubuntu2.2+esm3","1.13.2+dfsg-5ubuntu2.2+esm4","1.13.2+dfsg-5ubuntu2.2+esm5","1.13.2+dfsg-5ubuntu2.2+esm6","1.13.2+dfsg-5ubuntu2.2+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-2","1.16-2","1.16-2build1","1.16-2ubuntu0.1","1.16-2ubuntu0.1+esm1","1.16-2ubuntu0.2","1.16-2ubuntu0.3","1.16-2ubuntu0.4","1.16-2ubuntu0.4+esm1","1.16-2ubuntu0.4+esm2","1.16-2ubuntu0.4+esm3","1.16-2ubuntu0.4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-6","1.17-6ubuntu3","1.17-6ubuntu4","1.17-6ubuntu4.1","1.17-6ubuntu4.2","1.17-6ubuntu4.3","1.17-6ubuntu4.4","1.17-6ubuntu4.6","1.17-6ubuntu4.7","1.17-6ubuntu4.8","1.17-6ubuntu4.9","1.17-6ubuntu4.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.3-6","1.18.3-7","1.19.2-0ubuntu1","1.19.2-1","1.19.2-2","1.19.2-2ubuntu0.1","1.19.2-2ubuntu0.2","1.19.2-2ubuntu0.3","1.19.2-2ubuntu0.4","1.19.2-2ubuntu0.5","1.19.2-2ubuntu0.6","1.19.2-2ubuntu0.7","1.19.2-2ubuntu0.8","1.19.2-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-3ubuntu1","1.20.1-5build1","1.20.1-6ubuntu1","1.20.1-6ubuntu2","1.20.1-6ubuntu2.1","1.20.1-6ubuntu2.2","1.20.1-6ubuntu2.3","1.20.1-6ubuntu2.4","1.20.1-6ubuntu2.5","1.20.1-6ubuntu2.6","1.20.1-6ubuntu2.7","1.20.1-6ubuntu2.8","1.20.1-6ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-2ubuntu4","1.22.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5ubuntu2","1.22.1-2","1.22.1-2ubuntu2","1.22.1-2ubuntu3","1.22.1-2ubuntu4","1.22.1-2ubuntu4.1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.2 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.8 extended update support"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:99624","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99625","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99716","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112321","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478448","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321"},{"url":"https://github.com/advisories/GHSA-7m7r-w6g3-6pph"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-112321","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-112321","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-112321","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-112321","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112321","tags":["report"]},{"url":"access.redhat.com/downloads/content/package-browser","tags":["report"]},{"url":"github.com/krb5/krb5/commit/89ea06778fe893a8fdad483f7716fe8309521603","tags":["report"]},{"url":"security-tracker.debian.org/tracker/cve-2026-112321","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-112321","title":"Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.","status":"published","published":"2026-11-09T19:08:10.347Z","modified":"2026-11-12T22:59:50.97Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-772"],"updated_at":"2026-11-12T23:49:59.845803Z"}],"euvd":[{"id":"EUVD-2026-120237","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.","status":"published","published":"2026-11-09T19:08:10Z","modified":"2026-11-12T23:01:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-13T00:36:24.879993Z"}],"ghsa":[{"id":"GHSA-7m7r-w6g3-6pph","title":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free...","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.","status":"published","published":"2026-11-09T21:31:46Z","modified":"2026-11-13T00:32:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-13T00:44:37.510355Z"}],"nvd":[{"id":"CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.","status":"published","published":"2026-11-09T19:16:41.05Z","modified":"2026-11-13T00:20:09.17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-772"],"updated_at":"2026-11-13T01:33:40.90068Z"}],"osv":[{"id":"ALPINE-CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.","status":"published","published":"2026-11-09T19:16:41.05Z","modified":"2026-11-10T15:30:03.184838049Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T16:03:01.153645Z"},{"id":"BELL-CVE-2026-112321","status":"published","published":"2026-11-10T06:06:21.81859Z","modified":"2026-11-12T07:15:06.093784721Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T07:34:27.866398Z"},{"id":"DEBIAN-CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.","status":"published","published":"2026-11-09T19:16:41.05Z","modified":"2026-11-10T05:00:06.476641998Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T05:22:46.487299Z"},{"id":"UBUNTU-CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.","status":"published","published":"2026-11-10T00:00:00Z","modified":"2026-11-12T17:25:21.646448543Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T18:05:20.294756Z"}]}}