KRB5 · CVE-2026-112323 · Other
FIX → 1.22.3
The AUTH_GSSAPI handler in MIT Kerberos 5 keeps client state for each failed AUTH_GSSAPI_INIT request for 15 minutes. A remote attacker can send many such requests to make kadmind run out of memory and stop serving.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems running MIT Kerberos 5 kadmind (the Kerberos admin daemon) with its RPC service reachable over the network, on krb5 versions before 1.22.3. Hosts that do not run kadmind or keep it off untrusted networks can skip it.
Not affected if kadmind-not-running, network-restricted
Who cares kadmind, kerberos, mit-kerberos, self-hosted
Upgrade to 1.22.3
Upgrade MIT krb5 to 1.22.3 or later (patch release per MITKRB5-SA-2026-001); distro packages: use the vendor's backport.
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.