CVE-2026-112315 · Package
NO FIX YET
MIT Kerberos 5 (krb5) 1.4 and later fail to free partially decoded buffers in the RPCSEC_GSS authentication code. A remote attacker sending crafted RPCSEC_GSS messages can cause a memory leak in kadmind, leading to denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems running MIT Kerberos 5 (krb5) with the kadmind administration daemon exposed to the network are the ones to look at. The sources do not list affected version ranges or a fixed version. Hosts where kadmind is not running or not reachable from the network are unlikely to be exposed.
Not affected if kadmind-not-running, no-network-exposure
Who cares kadmind, kerberos, krb5, linux
klist --version or kadmind -version where availablekadmind is running on the host and reachable from the networkNo fix yet, per the sources.
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.