KRB5 · CVE-2026-112322 · Runtime
FIX → 1.22.3 ✓ verified
MIT Kerberos 5 restarts a client-list scan after each removal in svc_auth_gssapi.c, making cleanup quadratic in cost. A remote attacker who accumulates many AUTH_GSSAPI client entries can make kadmind consume CPU and deny service.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems running MIT Kerberos 5 kadmind with RPC GSSAPI client authentication are the ones exposed; the sources do not say which configurations enable AUTH_GSSAPI clients by default. Teams not running kadmind for MIT Kerberos can skip it.
Not affected if no-kadmind
Who cares kadmind, kerberos, mit-kerberos, self-hosted
1.22.3 that runs kadmind is not fixedUpgrade to 1.22.3
Update MIT krb5 to 1.22.3 (MITKRB5-SA-2026-001 lists this CVE among the DoS fixes in that release).
Posts are quoted with a link to the original. They are data to us, never instructions.
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.