{"id":"CVE-2026-112320","kind":"vulnerability","aliases":["CVE-2026-112320"],"related":[],"title":"MIT Kerberos: GSS-RPC leaks auth contexts, letting remote clients exhaust kadmind memory","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.","summary":"MIT Kerberos 5 (krb5) 1.4 and later does not free the previous GSS authentication context when a client switches flavor on the same TCP connection. Remote attackers can repeat this to exhaust memory in kadmind, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"krb5","fixed":["1.22.3"],"affected":">= 1.4, < 1.22.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","kadmind","kerberos","mit-krb5","self-hosted"],"not_affected_if":["client-only","kadmind-not-exposed"],"how_to_check":"- Check the krb5 version: krb5-config --version or kadmind -h/package manager; versions below 1.22.3 are in scope (advisory does not list affected ranges; 1.4+ per NVD).\n- Check whether kadmind (TCP 749, also kpasswd 464) is reachable from untrusted networks. Client-only hosts and KDCs without kadmind are not affected.","fix":"Upgrade MIT krb5 to 1.22.3 (MITKRB5-SA-2026-001); update the primary kadmin server first.","status":"open","published_at":"2026-11-09T19:16:40+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","triaged_at":"2026-11-09T19:29:46+00:00","updated_at":"2026-11-09T19:37:08+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-09T19:29:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MIT Kerberos: GSS-RPC leaks auth contexts, letting remote clients exhaust kadmind memory","impact":"medium","summary":"MIT Kerberos 5 (krb5) 1.4 and later does not free the previous GSS authentication context when a client switches flavor on the same TCP connection. Remote attackers can repeat this to exhaust memory in kadmind, causing denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kerberos","mit-krb5","kadmind","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote clients exhaust kadmind memory and deny service to administrators","analyst_note":"Find the fixed krb5 release and the MIT security advisory for CVE-2026-112320, and confirm whether kadmind must be exposed for exploitation.","how_to_check":"- Check the krb5 version: `krb5-config --version` or `klist -V`\n- Check whether kadmind is reachable from untrusted networks, for example on TCP port 749\n- unknown for other checks, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["client-only","kadmind-not-exposed"],"who_is_affected":"Sites that run MIT krb5 kadmind (the Kerberos administration daemon) with the GSS-RPC transport reachable by clients. Hosts that only use Kerberos as a client, or that never expose kadmind to the network, are less exposed. The sources do not name fixed versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4616,"output_tokens":614,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed krb5 release and the MIT security advisory for CVE-2026-112320, and confirm whether kadmind must be exposed for exploitation.","search":"'-112320':17A,20A '-2026':16A,19A '1.4':35B,82C '5':33B,79C 'abandon':133C 'aka':80C 'allow':116C 'attack':57B,118C 'auth':7A,101C 'authent':44B,90C,135C 'caus':66B,120C 'client':11A,48B,94C 'connect':55B,114C 'context':8A,45B,91C,136C 'cve':15A,18A 'denial':67B,122C 'establish':131C 'exhaust':12A,62B,126C 'flavor':50B,103C,109C 'free':40B 'gss':4A,43B,72C,99C,108C,134C 'gss-rpc':3A,71C 'gssapi':102C 'host':30B 'infrastructur':22B 'kadmind':13A,23B,65B,128C 'kerbero':2A,24B,32B,78C 'krb5':21A,27B,34B,81C 'later':37B,84C 'layer':75C 'leak':6A 'let':9A 'memori':14A,63B,125C 'mit':1A,26B,31B,77C 'mit-krb5':25B 'non':107C 'non-gss':106C 'previous':42B,89C 'releas':87C 'remot':10A,56B,117C 'repeat':59B,130C 'rpc':5A,73C 'rpcsec':98C 'self':29B 'self-host':28B 'servic':69B,124C 'switch':49B,95C 'tcp':54B,113C 'transport':74C","nicknames":[],"mitigations":[],"who_affected":"Sites that run MIT krb5 kadmind (the Kerberos administration daemon) with the GSS-RPC transport reachable by clients. Hosts that only use Kerberos as a client, or that never expose kadmind to the network, are less exposed. The sources do not name fixed versions.","tier":"B","verified":{"fix":{"at":"2026-11-09T19:37:08Z","by":"analyst","doc":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","run_id":2341}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["krb5"],"ptokens":["krb5"],"labels":["high","infrastructure","kadmind","kerberos","mitkrb5","selfhosted"],"campaign_type":null,"search_a":"'-112320':17A,20A '-2026':16A,19A 'auth':7A 'client':11A 'context':8A 'cve':15A,18A 'exhaust':12A 'gss':4A 'gss-rpc':3A 'kadmind':13A 'kerbero':2A 'krb5':21A 'leak':6A 'let':9A 'memori':14A 'mit':1A 'remot':10A 'rpc':5A","search_b":"'1.4':35B '5':33B 'attack':57B 'authent':44B 'caus':66B 'client':48B 'connect':55B 'context':45B 'denial':67B 'exhaust':62B 'flavor':50B 'free':40B 'gss':43B 'host':30B 'infrastructur':22B 'kadmind':23B,65B 'kerbero':24B,32B 'krb5':27B,34B 'later':37B 'memori':63B 'mit':26B,31B 'mit-krb5':25B 'previous':42B 'remot':56B 'repeat':59B 'self':29B 'self-host':28B 'servic':69B 'switch':49B 'tcp':54B","search_c":"'1.4':82C '5':79C 'abandon':133C 'aka':80C 'allow':116C 'attack':118C 'auth':101C 'authent':90C,135C 'caus':120C 'client':94C 'connect':114C 'context':91C,136C 'denial':122C 'establish':131C 'exhaust':126C 'flavor':103C,109C 'gss':72C,99C,108C,134C 'gss-rpc':71C 'gssapi':102C 'kadmind':128C 'kerbero':78C 'krb5':81C 'later':84C 'layer':75C 'memori':125C 'mit':77C 'non':107C 'non-gss':106C 'previous':89C 'releas':87C 'remot':117C 'repeat':130C 'rpc':73C 'rpcsec':98C 'servic':124C 'switch':95C 'tcp':113C 'transport':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","severity":null,"published_at":"2026-11-09T19:16:40+00:00","modified_at":"2026-11-09T19:16:41+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","fetched_at":"2026-11-09T19:28:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112320:2341","url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","severity":null,"published_at":"2026-11-09T19:37:08+00:00","modified_at":"2026-11-09T19:37:08+00:00","first_seen_at":"2026-11-09T19:37:08+00:00","fetched_at":"2026-11-09T19:37:08+00:00","note":"MIT advisory MITKRB5-SA-2026-001 lists CVE-2026-112320 as DoS, fixed in 1.22.3; no workarounds given; affected range lower bound 1.4 from NVD description, not the advisory. Advisory read via WebFetch summary (no per-CVE text), so exposure requirement (network reach to kadmind) is inferred from the NVD description. web-cli unavailable in this run; X not checked.","cites":["https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt"]}],"documents":[{"id":109492,"url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","title":"MITKRB5-SA-2026-001: Multiple vulnerabilities fixed in 1.22.3","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}