KRB5 · CVE-2026-112321 · Package
FIX → 1.22.3
The AUTH_GSSAPI handler in MIT Kerberos 5 does not free decoded arguments on some error paths. A remote attacker can send crafted AUTH_GSSAPI_INIT requests that trigger authentication failures and exhaust memory in kadmind, causing denial of service.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affected systems are those running kadmind, the MIT Kerberos administration daemon, reachable over the network. Systems that do not run kadmind, or where it is not reachable by untrusted hosts, are less exposed. The sources do not name affected version ranges.
Not affected if kadmind-not-running, network-restricted
Who cares kadmind, kerberos, mit-kerberos, self-hosted
Upgrade to 1.22.3
1.22.3 or later (MITKRB5-SA-2026-001 lists this CVE among its DoS fixes; no per-CVE mapping given)The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.