{"id":"CVE-2026-112321","kind":"vulnerability","aliases":["CVE-2026-112321"],"related":[],"title":"MIT Kerberos 5: memory leak lets remote requests exhaust kadmind memory","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.","summary":"The AUTH_GSSAPI handler in MIT Kerberos 5 does not free decoded arguments on some error paths. A remote attacker can send crafted AUTH_GSSAPI_INIT requests that trigger authentication failures and exhaust memory in kadmind, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"krb5","fixed":["1.22.3"],"affected":"< 1.22.3 (lower bound unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["kadmind","kerberos","mit-kerberos","package","self-hosted"],"not_affected_if":["kadmind-not-running","network-restricted"],"how_to_check":"- Check the krb5 version (rpm -q krb5-server / dpkg -l krb5-admin-server); below 1.22.3 may be affected, though distro builds may backport fixes. The lower bound of affected versions is not stated by MIT.\n- Check whether kadmind is running and whether its port (749/tcp) is reachable from untrusted networks.","fix":"Upgrade MIT krb5 to 1.22.3 or later (MITKRB5-SA-2026-001 lists this CVE among its DoS fixes; no per-CVE mapping given). Distro packages: use the vendor's backport.","status":"open","published_at":"2026-11-09T19:16:41+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","triaged_at":"2026-11-09T19:29:45+00:00","updated_at":"2026-11-09T19:37:13+00:00","category":"package","confidence":0.55,"triage":{"at":"2026-11-09T19:29:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MIT Kerberos 5: memory leak lets remote requests exhaust kadmind memory","impact":"low","summary":"The AUTH_GSSAPI handler in MIT Kerberos 5 does not free decoded arguments on some error paths. A remote attacker can send crafted AUTH_GSSAPI_INIT requests that trigger authentication failures and exhaust memory in kadmind, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kerberos","kadmind","mit-kerberos","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"kadmind runs out of memory and stops serving requests","analyst_note":"Find affected and fixed krb5 versions and the NVD entry details for CVE-2026-112321 at https://nvd.nist.gov/vuln/detail/CVE-2026-112321.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["kadmind-not-running","network-restricted"],"who_is_affected":"Affected systems are those running kadmind, the MIT Kerberos administration daemon, reachable over the network. Systems that do not run kadmind, or where it is not reachable by untrusted hosts, are less exposed. The sources do not name affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4609,"output_tokens":518,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed krb5 versions and the NVD entry details for CVE-2026-112321 at https://nvd.nist.gov/vuln/detail/CVE-2026-112321.","search":"'-112321':14A,17A '-2026':13A,16A '5':3A,35B,77C 'aka':78C 'allow':90C 'argument':40B,84C 'attack':47B,92C 'auth':29B,51B,69C,105C 'authent':57B,111C 'caus':64B,94C 'certain':86C 'craft':50B,104C 'cve':12A,15A 'decod':39B,83C 'denial':65B,96C 'error':43B,87C 'exhaust':9A,60B,100C 'failur':58B,112C 'free':38B,82C 'gssapi':30B,52B,70C,106C 'handler':31B,71C 'host':27B 'init':53B,107C 'kadmind':10A,19B,63B,102C 'kerbero':2A,20B,23B,34B,76C 'krb5':18A,79C 'leak':5A 'let':6A 'lib/rpc/svc_auth_gssapi.c':73C 'memori':4A,11A,61B,99C 'mit':1A,22B,33B,75C 'mit-kerbero':21B 'packag':24B 'path':44B,88C 'remot':7A,46B,91C 'request':8A,54B,108C 'self':26B 'self-host':25B 'send':49B 'servic':67B,98C 'trigger':56B,110C 'via':103C","nicknames":[],"mitigations":[],"who_affected":"Affected systems are those running kadmind, the MIT Kerberos administration daemon, reachable over the network. Systems that do not run kadmind, or where it is not reachable by untrusted hosts, are less exposed. The sources do not name affected version ranges.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["krb5"],"ptokens":["krb5"],"labels":["high","kadmind","kerberos","mitkerberos","package","selfhosted"],"campaign_type":null,"search_a":"'-112321':14A,17A '-2026':13A,16A '5':3A 'cve':12A,15A 'exhaust':9A 'kadmind':10A 'kerbero':2A 'krb5':18A 'leak':5A 'let':6A 'memori':4A,11A 'mit':1A 'remot':7A 'request':8A","search_b":"'5':35B 'argument':40B 'attack':47B 'auth':29B,51B 'authent':57B 'caus':64B 'craft':50B 'decod':39B 'denial':65B 'error':43B 'exhaust':60B 'failur':58B 'free':38B 'gssapi':30B,52B 'handler':31B 'host':27B 'init':53B 'kadmind':19B,63B 'kerbero':20B,23B,34B 'memori':61B 'mit':22B,33B 'mit-kerbero':21B 'packag':24B 'path':44B 'remot':46B 'request':54B 'self':26B 'self-host':25B 'send':49B 'servic':67B 'trigger':56B","search_c":"'5':77C 'aka':78C 'allow':90C 'argument':84C 'attack':92C 'auth':69C,105C 'authent':111C 'caus':94C 'certain':86C 'craft':104C 'decod':83C 'denial':96C 'error':87C 'exhaust':100C 'failur':112C 'free':82C 'gssapi':70C,106C 'handler':71C 'init':107C 'kadmind':102C 'kerbero':76C 'krb5':79C 'lib/rpc/svc_auth_gssapi.c':73C 'memori':99C 'mit':75C 'path':88C 'remot':91C 'request':108C 'servic':98C 'trigger':110C 'via':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","severity":null,"published_at":"2026-11-09T19:16:41+00:00","modified_at":"2026-11-09T19:16:41+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","fetched_at":"2026-11-09T19:28:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112321:2340","url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","severity":null,"published_at":"2026-11-09T19:37:13+00:00","modified_at":"2026-11-09T19:37:13+00:00","first_seen_at":"2026-11-09T19:37:13+00:00","fetched_at":"2026-11-09T19:37:13+00:00","note":"MIT advisory MITKRB5-SA-2026-001 (read via page summarizer; Exa credits exhausted) lists this CVE in its DoS section and is a patch release 1.22.3; no per-CVE detail or affected lower bound. Fix inferred from advisory-level release, so nothing marked verified. Re-read raw advisory to confirm. Siblings CVE-2026-112323 and -119079 are in same advisory.","cites":["https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt"]}],"documents":[{"id":109492,"url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","title":"MITKRB5-SA-2026-001: Multiple vulnerabilities fixed in 1.22.3","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}