KRB5 · CVE-2026-112320 · Infrastructure
FIX → 1.22.3 ✓ verified
MIT Kerberos 5 (krb5) 1.4 and later does not free the previous GSS authentication context when a client switches flavor on the same TCP connection. Remote attackers can repeat this to exhaust memory in kadmind, causing denial of service.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites that run MIT krb5 kadmind (the Kerberos administration daemon) with the GSS-RPC transport reachable by clients. Hosts that only use Kerberos as a client, or that never expose kadmind to the network, are less exposed. The sources do not name fixed versions.
Not affected if client-only, kadmind-not-exposed
Who cares kadmind, kerberos, mit-krb5, self-hosted
Upgrade to 1.22.3
Upgrade MIT krb5 to 1.22.3 (MITKRB5-SA-2026-001); update the primary kadmin server first.
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.