{"id":"CVE-2026-112322","aliases":["ALPINE-CVE-2026-112322","BELL-CVE-2026-112322","DEBIAN-CVE-2026-112322","EUVD-2026-120224","GHSA-67w6-q7fj-jmqf","UBUNTU-CVE-2026-112322"],"status":"published","title":"Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00779,"percentile":0.56383,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-11-09T18:43:23Z","modified":"2026-11-12T16:47:57Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r2"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-2","1.20.1-2+deb12u1","1.20.1-2+deb12u2","1.20.1-2+deb12u3","1.20.1-2+deb12u4","1.20.1-2+deb12u5","1.20.1-2+loong64","1.20.1-3","1.20.1-4","1.20.1-5","1.20.1-5.1","1.20.1-5.1~exp1","1.20.1-6","1.21.2-1","1.21.3-1","1.21.3-2","1.21.3-3","1.21.3-4","1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.21.3-5+deb13u1","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1+dfsg-6.1ubuntu1","1.11.3+dfsg-3ubuntu2","1.12+dfsg-2ubuntu1","1.12+dfsg-2ubuntu2","1.12+dfsg-2ubuntu3","1.12+dfsg-2ubuntu4","1.12+dfsg-2ubuntu4.2","1.12+dfsg-2ubuntu5","1.12+dfsg-2ubuntu5.1","1.12+dfsg-2ubuntu5.2","1.12+dfsg-2ubuntu5.3","1.12+dfsg-2ubuntu5.4","1.12+dfsg-2ubuntu5.4+esm1","1.12+dfsg-2ubuntu5.4+esm2","1.12+dfsg-2ubuntu5.4+esm3","1.12+dfsg-2ubuntu5.4+esm4","1.12+dfsg-2ubuntu5.4+esm5","1.12+dfsg-2ubuntu5.4+esm6","1.12+dfsg-2ubuntu5.4+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-2","1.13.2+dfsg-3","1.13.2+dfsg-4","1.13.2+dfsg-5","1.13.2+dfsg-5ubuntu1","1.13.2+dfsg-5ubuntu2","1.13.2+dfsg-5ubuntu2.1","1.13.2+dfsg-5ubuntu2.1+esm1","1.13.2+dfsg-5ubuntu2.2","1.13.2+dfsg-5ubuntu2.2+esm1","1.13.2+dfsg-5ubuntu2.2+esm2","1.13.2+dfsg-5ubuntu2.2+esm3","1.13.2+dfsg-5ubuntu2.2+esm4","1.13.2+dfsg-5ubuntu2.2+esm5","1.13.2+dfsg-5ubuntu2.2+esm6","1.13.2+dfsg-5ubuntu2.2+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-2","1.16-2","1.16-2build1","1.16-2ubuntu0.1","1.16-2ubuntu0.1+esm1","1.16-2ubuntu0.2","1.16-2ubuntu0.3","1.16-2ubuntu0.4","1.16-2ubuntu0.4+esm1","1.16-2ubuntu0.4+esm2","1.16-2ubuntu0.4+esm3","1.16-2ubuntu0.4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-6","1.17-6ubuntu3","1.17-6ubuntu4","1.17-6ubuntu4.1","1.17-6ubuntu4.2","1.17-6ubuntu4.3","1.17-6ubuntu4.4","1.17-6ubuntu4.6","1.17-6ubuntu4.7","1.17-6ubuntu4.8","1.17-6ubuntu4.9","1.17-6ubuntu4.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.3-6","1.18.3-7","1.19.2-0ubuntu1","1.19.2-1","1.19.2-2","1.19.2-2ubuntu0.1","1.19.2-2ubuntu0.2","1.19.2-2ubuntu0.3","1.19.2-2ubuntu0.4","1.19.2-2ubuntu0.5","1.19.2-2ubuntu0.6","1.19.2-2ubuntu0.7","1.19.2-2ubuntu0.8","1.19.2-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-3ubuntu1","1.20.1-5build1","1.20.1-6ubuntu1","1.20.1-6ubuntu2","1.20.1-6ubuntu2.1","1.20.1-6ubuntu2.2","1.20.1-6ubuntu2.3","1.20.1-6ubuntu2.4","1.20.1-6ubuntu2.5","1.20.1-6ubuntu2.6","1.20.1-6ubuntu2.7","1.20.1-6ubuntu2.8","1.20.1-6ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-2ubuntu4","1.22.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5ubuntu2","1.22.1-2","1.22.1-2ubuntu2","1.22.1-2ubuntu3","1.22.1-2ubuntu4","1.22.1-2ubuntu4.1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.2 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:99624","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99625","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112322","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478445","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322"},{"url":"https://github.com/advisories/GHSA-67w6-q7fj-jmqf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-112322","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-112322","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-112322","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-112322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112322","tags":["report"]},{"url":"access.redhat.com/downloads/content/package-browser","tags":["report"]},{"url":"bugzilla.redhat.com/show_bug.cgi?id=2478445","tags":["report"]},{"url":"github.com/krb5/krb5/commit/8aab893c6eb17125e1518f9926bc3593cf19303c","tags":["report"]},{"url":"security-tracker.debian.org/tracker/cve-2026-112322","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-112322","title":"Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.","status":"published","published":"2026-11-09T18:43:23.841Z","modified":"2026-11-12T16:47:57.396Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-12T17:45:33.975029Z"}],"euvd":[{"id":"EUVD-2026-120224","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.","status":"published","published":"2026-11-09T18:43:23Z","modified":"2026-11-12T16:47:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T18:34:26.744434Z"}],"ghsa":[{"id":"GHSA-67w6-q7fj-jmqf","title":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from...","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.","status":"published","published":"2026-11-09T21:31:46Z","modified":"2026-11-12T18:32:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-12T18:42:39.121023Z"}],"nvd":[{"id":"CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.","status":"published","published":"2026-11-09T19:16:41.207Z","modified":"2026-11-12T17:17:23.28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-12T19:32:18.475158Z"}],"osv":[{"id":"ALPINE-CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.","status":"published","published":"2026-11-09T19:16:41.207Z","modified":"2026-11-10T15:30:04.209600178Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T16:03:01.153645Z"},{"id":"BELL-CVE-2026-112322","status":"published","published":"2026-11-10T06:06:21.140564Z","modified":"2026-11-12T07:15:04.189971455Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T07:34:29.179757Z"},{"id":"DEBIAN-CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.","status":"published","published":"2026-11-09T19:16:41.207Z","modified":"2026-11-10T05:00:06.478479461Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T05:22:46.487299Z"},{"id":"UBUNTU-CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.","status":"published","published":"2026-11-10T00:00:00Z","modified":"2026-11-12T17:25:21.345846971Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T18:05:20.294756Z"}]}}