{"id":"CVE-2026-112317","kind":"vulnerability","aliases":["CVE-2026-112317"],"related":[],"title":"MIT Kerberos: failed key decryption leaks memory, letting remote requests exhaust KDC","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.","summary":"In MIT Kerberos 5 (krb5) 1.2.8 and later, krb5_ktkdb_get_entry() does not free decrypted key material when a post-decryption check fails. Remote attackers who repeatedly trigger key decryption failures can cause a memory leak in the KDC or kadmind, leading to denial of service.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"krb5","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["kadmind","kdc","kerberos","krb5","package","self-hosted"],"not_affected_if":["client-only","other-kerberos-implementation"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T19:16:40+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","triaged_at":"2026-11-09T19:32:10+00:00","updated_at":"2026-11-09T19:32:10+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T19:32:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MIT Kerberos: failed key decryption leaks memory, letting remote requests exhaust KDC","impact":"low","summary":"In MIT Kerberos 5 (krb5) 1.2.8 and later, krb5_ktkdb_get_entry() does not free decrypted key material when a post-decryption check fails. Remote attackers who repeatedly trigger key decryption failures can cause a memory leak in the KDC or kadmind, leading to denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kerberos","krb5","kdc","kadmind","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote requests exhaust memory and crash the KDC or kadmind","analyst_note":"Check the MIT krb5 advisory and the fixed release version, and whether the KDC path is reachable without authentication.","how_to_check":"unknown","plain_action":"","product_name":"krb5","needs_analyst":true,"not_affected_if":["client-only","other-kerberos-implementation"],"who_is_affected":"Sites running the MIT Kerberos KDC or kadmind from krb5 1.2.8 or later are potentially exposed to memory exhaustion through crafted requests. Hosts that only use Kerberos clients, or run other Kerberos implementations, are not affected by this flaw. The sources do not say which configurations trigger the code path.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4608,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112317':15A,18A '-2026':14A,17A '1.2.8':33B,88C '5':31B,85C 'aka':86C 'allow':105C 'attack':54B,107C 'caus':62B,109C 'check':51B,102C 'cve':13A,16A 'decrypt':5A,43B,50B,59B,94C,101C,127C 'denial':73B,111C 'entri':39B,79C 'exhaust':11A 'fail':3A,52B,103C 'failur':60B,128C 'free':42B,93C 'get':38B,78C 'host':27B 'kadmind':20B,70B,120C 'kdc':12A,21B,68B,118C 'kerbero':2A,22B,30B,84C 'key':4A,44B,58B,95C,126C 'krb5':19A,23B,32B,36B,76C,87C 'ktkdb':37B,77C 'later':35B,90C 'lead':71B 'leak':6A,65B,115C 'let':8A 'lib/kdb/keytab.c':81C 'materi':45B,96C 'memori':7A,64B,114C 'mit':1A,29B,83C 'packag':24B 'post':49B,100C 'post-decrypt':48B,99C 'remot':9A,53B,106C 'repeat':56B,124C 'request':10A,122C 'self':26B 'self-host':25B 'servic':75B,113C 'trigger':57B,125C 'via':121C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MIT Kerberos KDC or kadmind from krb5 1.2.8 or later are potentially exposed to memory exhaustion through crafted requests. Hosts that only use Kerberos clients, or run other Kerberos implementations, are not affected by this flaw. The sources do not say which configurations trigger the code path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["krb5"],"ptokens":["krb5"],"labels":["kadmind","kdc","kerberos","krb5","medium","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-112317':15A,18A '-2026':14A,17A 'cve':13A,16A 'decrypt':5A 'exhaust':11A 'fail':3A 'kdc':12A 'kerbero':2A 'key':4A 'krb5':19A 'leak':6A 'let':8A 'memori':7A 'mit':1A 'remot':9A 'request':10A","search_b":"'1.2.8':33B '5':31B 'attack':54B 'caus':62B 'check':51B 'decrypt':43B,50B,59B 'denial':73B 'entri':39B 'fail':52B 'failur':60B 'free':42B 'get':38B 'host':27B 'kadmind':20B,70B 'kdc':21B,68B 'kerbero':22B,30B 'key':44B,58B 'krb5':23B,32B,36B 'ktkdb':37B 'later':35B 'lead':71B 'leak':65B 'materi':45B 'memori':64B 'mit':29B 'packag':24B 'post':49B 'post-decrypt':48B 'remot':53B 'repeat':56B 'self':26B 'self-host':25B 'servic':75B 'trigger':57B","search_c":"'1.2.8':88C '5':85C 'aka':86C 'allow':105C 'attack':107C 'caus':109C 'check':102C 'decrypt':94C,101C,127C 'denial':111C 'entri':79C 'fail':103C 'failur':128C 'free':93C 'get':78C 'kadmind':120C 'kdc':118C 'kerbero':84C 'key':95C,126C 'krb5':76C,87C 'ktkdb':77C 'later':90C 'leak':115C 'lib/kdb/keytab.c':81C 'materi':96C 'memori':114C 'mit':83C 'post':100C 'post-decrypt':99C 'remot':106C 'repeat':124C 'request':122C 'servic':113C 'trigger':125C 'via':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","severity":null,"published_at":"2026-11-09T19:16:40+00:00","modified_at":"2026-11-09T19:16:40+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","fetched_at":"2026-11-09T19:28:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}