{"id":"CVE-2026-112323","aliases":["ALPINE-CVE-2026-112323","BELL-CVE-2026-112323","DEBIAN-CVE-2026-112323","EUVD-2026-120225","GHSA-jvj7-cww2-9jj3","UBUNTU-CVE-2026-112323"],"status":"published","title":"Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00638,"percentile":0.51075,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2026-11-09T18:43:29Z","modified":"2026-11-12T23:00:03Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"krb5","fixed_in":["1.22.3-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-r2"},{"fixed":"1.22.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-2","1.20.1-2+deb12u1","1.20.1-2+deb12u2","1.20.1-2+deb12u3","1.20.1-2+deb12u4","1.20.1-2+deb12u5","1.20.1-2+loong64","1.20.1-3","1.20.1-4","1.20.1-5","1.20.1-5.1","1.20.1-5.1~exp1","1.20.1-6","1.21.2-1","1.21.3-1","1.21.3-2","1.21.3-3","1.21.3-4","1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.21.3-5+deb13u1","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5","1.22.1-1","1.22.1-2","1.22.1-2.1","1.22.1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1+dfsg-6.1ubuntu1","1.11.3+dfsg-3ubuntu2","1.12+dfsg-2ubuntu1","1.12+dfsg-2ubuntu2","1.12+dfsg-2ubuntu3","1.12+dfsg-2ubuntu4","1.12+dfsg-2ubuntu4.2","1.12+dfsg-2ubuntu5","1.12+dfsg-2ubuntu5.1","1.12+dfsg-2ubuntu5.2","1.12+dfsg-2ubuntu5.3","1.12+dfsg-2ubuntu5.4","1.12+dfsg-2ubuntu5.4+esm1","1.12+dfsg-2ubuntu5.4+esm2","1.12+dfsg-2ubuntu5.4+esm3","1.12+dfsg-2ubuntu5.4+esm4","1.12+dfsg-2ubuntu5.4+esm5","1.12+dfsg-2ubuntu5.4+esm6","1.12+dfsg-2ubuntu5.4+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-2","1.13.2+dfsg-3","1.13.2+dfsg-4","1.13.2+dfsg-5","1.13.2+dfsg-5ubuntu1","1.13.2+dfsg-5ubuntu2","1.13.2+dfsg-5ubuntu2.1","1.13.2+dfsg-5ubuntu2.1+esm1","1.13.2+dfsg-5ubuntu2.2","1.13.2+dfsg-5ubuntu2.2+esm1","1.13.2+dfsg-5ubuntu2.2+esm2","1.13.2+dfsg-5ubuntu2.2+esm3","1.13.2+dfsg-5ubuntu2.2+esm4","1.13.2+dfsg-5ubuntu2.2+esm5","1.13.2+dfsg-5ubuntu2.2+esm6","1.13.2+dfsg-5ubuntu2.2+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-2","1.16-2","1.16-2build1","1.16-2ubuntu0.1","1.16-2ubuntu0.1+esm1","1.16-2ubuntu0.2","1.16-2ubuntu0.3","1.16-2ubuntu0.4","1.16-2ubuntu0.4+esm1","1.16-2ubuntu0.4+esm2","1.16-2ubuntu0.4+esm3","1.16-2ubuntu0.4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-6","1.17-6ubuntu3","1.17-6ubuntu4","1.17-6ubuntu4.1","1.17-6ubuntu4.2","1.17-6ubuntu4.3","1.17-6ubuntu4.4","1.17-6ubuntu4.6","1.17-6ubuntu4.7","1.17-6ubuntu4.8","1.17-6ubuntu4.9","1.17-6ubuntu4.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.3-6","1.18.3-7","1.19.2-0ubuntu1","1.19.2-1","1.19.2-2","1.19.2-2ubuntu0.1","1.19.2-2ubuntu0.2","1.19.2-2ubuntu0.3","1.19.2-2ubuntu0.4","1.19.2-2ubuntu0.5","1.19.2-2ubuntu0.6","1.19.2-2ubuntu0.7","1.19.2-2ubuntu0.8","1.19.2-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1-3ubuntu1","1.20.1-5build1","1.20.1-6ubuntu1","1.20.1-6ubuntu2","1.20.1-6ubuntu2.1","1.20.1-6ubuntu2.2","1.20.1-6ubuntu2.3","1.20.1-6ubuntu2.4","1.20.1-6ubuntu2.5","1.20.1-6ubuntu2.6","1.20.1-6ubuntu2.7","1.20.1-6ubuntu2.8","1.20.1-6ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-2ubuntu4","1.22.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3-5ubuntu2","1.22.1-2","1.22.1-2ubuntu2","1.22.1-2ubuntu3","1.22.1-2ubuntu4","1.22.1-2ubuntu4.1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.2 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.8 extended update support"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:99624","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99625","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99716","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112323","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478440","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323"},{"url":"https://github.com/advisories/GHSA-jvj7-cww2-9jj3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-112323","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-112323","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-112323","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-112323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112323","tags":["report"]},{"url":"access.redhat.com/downloads/content/package-browser","tags":["report"]},{"url":"bugzilla.redhat.com/show_bug.cgi?id=2478440","tags":["report"]},{"url":"github.com/krb5/krb5/commit/8aab893c6eb17125e1518f9926bc3593cf19303c","tags":["report"]},{"url":"security-tracker.debian.org/tracker/cve-2026-112323","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-112323","title":"Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.","status":"published","published":"2026-11-09T18:43:29.636Z","modified":"2026-11-12T23:00:03.971Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-772"],"updated_at":"2026-11-12T23:49:59.845803Z"}],"euvd":[{"id":"EUVD-2026-120225","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.","status":"published","published":"2026-11-09T18:43:29Z","modified":"2026-11-12T23:01:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-13T00:36:24.879993Z"}],"ghsa":[{"id":"GHSA-jvj7-cww2-9jj3","title":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later...","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.","status":"published","published":"2026-11-09T21:31:46Z","modified":"2026-11-13T00:31:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-13T00:44:37.510355Z"}],"nvd":[{"id":"CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.","status":"published","published":"2026-11-09T19:16:41.36Z","modified":"2026-11-12T17:17:23.43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-772"],"updated_at":"2026-11-12T19:32:18.475158Z"}],"osv":[{"id":"ALPINE-CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.","status":"published","published":"2026-11-09T19:16:41.36Z","modified":"2026-11-10T15:30:03.174858111Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T16:03:01.153645Z"},{"id":"BELL-CVE-2026-112323","status":"published","published":"2026-11-10T06:06:21.199385Z","modified":"2026-11-12T07:15:04.381809259Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T07:34:29.179757Z"},{"id":"DEBIAN-CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.","status":"published","published":"2026-11-09T19:16:41.36Z","modified":"2026-11-10T05:00:06.484945845Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T05:22:46.487299Z"},{"id":"UBUNTU-CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.","status":"published","published":"2026-11-10T00:00:00Z","modified":"2026-11-12T17:25:21.248329298Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T18:05:20.294756Z"}]}}