KRB5 · CVE-2026-112317 · Package
NO FIX YET
In MIT Kerberos 5 (krb5) 1.2.8 and later, krb5_ktkdb_get_entry() does not free decrypted key material when a post-decryption check fails. Remote attackers who repeatedly trigger key decryption failures can cause a memory leak in the KDC or kadmind, leading to denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the MIT Kerberos KDC or kadmind from krb5 1.2.8 or later are potentially exposed to memory exhaustion through crafted requests. Hosts that only use Kerberos clients, or run other Kerberos implementations, are not affected by this flaw. The sources do not say which configurations trigger the code path.
Not affected if client-only, other-kerberos-implementation
Who cares kadmind, kdc, kerberos, krb5, self-hosted
Unknown from the sources.
No fix yet, per the sources.
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.