{"id":"CVE-2026-112322","kind":"vulnerability","aliases":["CVE-2026-112322"],"related":[],"title":"MIT Kerberos: client cleanup lets remote attackers exhaust CPU in kadmind","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.","summary":"MIT Kerberos 5 restarts a client-list scan after each removal in svc_auth_gssapi.c, making cleanup quadratic in cost. A remote attacker who accumulates many AUTH_GSSAPI client entries can make kadmind consume CPU and deny service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"krb5","fixed":["1.22.3"],"affected":"< 1.22.3 (lower bound not stated by MIT)","ecosystem":"vendor"}],"ecosystems":[],"tags":["kadmind","kerberos","mit-kerberos","runtime","self-hosted"],"not_affected_if":["no-kadmind"],"how_to_check":"Run kadmind -h or check your krb5 package version (e.g. krb5-config --version); anything older than 1.22.3 that runs kadmind is not fixed. Affected version floor is not stated by MIT.","fix":"Update MIT krb5 to 1.22.3 (MITKRB5-SA-2026-001 lists this CVE among the DoS fixes in that release).","status":"open","published_at":"2026-11-09T19:16:41+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","triaged_at":"2026-11-09T19:29:42+00:00","updated_at":"2026-11-09T19:37:16+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T19:29:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MIT Kerberos: client cleanup lets remote attackers exhaust CPU in kadmind","impact":"low","summary":"MIT Kerberos 5 restarts a client-list scan after each removal in svc_auth_gssapi.c, making cleanup quadratic in cost. A remote attacker who accumulates many AUTH_GSSAPI client entries can make kadmind consume CPU and deny service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["kerberos","mit-kerberos","kadmind","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kadmind CPU exhaustion causes denial of service","analyst_note":"Confirm affected krb5 version ranges, fixed release, and whether AUTH_GSSAPI is reachable by default; check the NVD entry and MIT krb5 advisories.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-kadmind"],"who_is_affected":"Systems running MIT Kerberos 5 kadmind with RPC GSSAPI client authentication are the ones exposed; the sources do not say which configurations enable AUTH_GSSAPI clients by default. Teams not running kadmind for MIT Kerberos can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000719,"input_tokens":4598,"output_tokens":519,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected krb5 version ranges, fixed release, and whether AUTH_GSSAPI is reachable by default; check the NVD entry and MIT krb5 advisories.","search":"'-112322':14A,17A '-2026':13A,16A '5':30B,74C 'accumul':53B,108C 'aka':75C 'attack':7A,51B,96C 'auth':42B,55B,113C 'caus':98C 'clean':67C 'cleanup':4A,45B 'client':3A,34B,57B,68C,85C,115C 'client-list':33B 'consum':62B 'consumpt':104C 'cost':48B,94C 'cpu':9A,63B,93C,103C 'cve':12A,15A 'deni':65B 'denial':100C 'entri':58B,116C 'exhaust':8A 'gssapi':56B,114C 'gssapi.c':43B 'head':82C 'host':27B 'kadmind':11A,19B,61B,106C 'kerbero':2A,20B,23B,29B,73C 'krb5':18A,76C 'larg':110C 'let':5A 'lib/rpc/svc_auth_gssapi.c':70C 'list':35B,86C 'make':44B,60B 'mani':54B 'mit':1A,22B,28B,72C 'mit-kerbero':21B 'number':111C 'quadrat':46B,92C 'remot':6A,50B,95C 'remov':39B,89C 'restart':31B,77C 'result':90C 'runtim':24B 'scan':36B,79C 'self':26B 'self-host':25B 'servic':66B,102C 'svc':41B","nicknames":[],"mitigations":[],"who_affected":"Systems running MIT Kerberos 5 kadmind with RPC GSSAPI client authentication are the ones exposed; the sources do not say which configurations enable AUTH_GSSAPI clients by default. Teams not running kadmind for MIT Kerberos can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-09T19:37:16Z","by":"analyst","doc":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","run_id":2339}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["krb5"],"ptokens":["krb5"],"labels":["high","kadmind","kerberos","mitkerberos","runtime","selfhosted"],"campaign_type":null,"search_a":"'-112322':14A,17A '-2026':13A,16A 'attack':7A 'cleanup':4A 'client':3A 'cpu':9A 'cve':12A,15A 'exhaust':8A 'kadmind':11A 'kerbero':2A 'krb5':18A 'let':5A 'mit':1A 'remot':6A","search_b":"'5':30B 'accumul':53B 'attack':51B 'auth':42B,55B 'cleanup':45B 'client':34B,57B 'client-list':33B 'consum':62B 'cost':48B 'cpu':63B 'deni':65B 'entri':58B 'gssapi':56B 'gssapi.c':43B 'host':27B 'kadmind':19B,61B 'kerbero':20B,23B,29B 'list':35B 'make':44B,60B 'mani':54B 'mit':22B,28B 'mit-kerbero':21B 'quadrat':46B 'remot':50B 'remov':39B 'restart':31B 'runtim':24B 'scan':36B 'self':26B 'self-host':25B 'servic':66B 'svc':41B","search_c":"'5':74C 'accumul':108C 'aka':75C 'attack':96C 'auth':113C 'caus':98C 'clean':67C 'client':68C,85C,115C 'consumpt':104C 'cost':94C 'cpu':93C,103C 'denial':100C 'entri':116C 'gssapi':114C 'head':82C 'kadmind':106C 'kerbero':73C 'krb5':76C 'larg':110C 'lib/rpc/svc_auth_gssapi.c':70C 'list':86C 'mit':72C 'number':111C 'quadrat':92C 'remot':95C 'remov':89C 'restart':77C 'result':90C 'scan':79C 'servic':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","severity":null,"published_at":"2026-11-09T19:16:41+00:00","modified_at":"2026-11-09T19:16:41+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","fetched_at":"2026-11-09T19:28:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112322:2339","url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","severity":null,"published_at":"2026-11-09T19:37:16+00:00","modified_at":"2026-11-09T19:37:16+00:00","first_seen_at":"2026-11-09T19:37:16+00:00","fetched_at":"2026-11-09T19:37:16+00:00","note":"MIT advisory MITKRB5-SA-2026-001 lists CVE-2026-112322 as DoS fixed in 1.22.3; it gives no per-CVE detail, affected floor, or default reachability of AUTH_GSSAPI. Web search was out of credits.","cites":["https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","https://nvd.nist.gov/vuln/detail/CVE-2026-112322"]}],"documents":[{"id":109492,"url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","title":"MITKRB5-SA-2026-001: Multiple vulnerabilities fixed in 1.22.3","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":109501,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","title":"NVD CVE-2026-112322","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}