{"id":"CVE-2026-112323","kind":"vulnerability","aliases":["CVE-2026-112323"],"related":[],"title":"MIT Kerberos: repeated failed GSSAPI requests exhaust kadmind memory","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.","summary":"The AUTH_GSSAPI handler in MIT Kerberos 5 keeps client state for each failed AUTH_GSSAPI_INIT request for 15 minutes. A remote attacker can send many such requests to make kadmind run out of memory and stop serving.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"krb5","fixed":["1.22.3"],"affected":">= 1.5.2, < 1.22.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["kadmind","kerberos","mit-kerberos","other","self-hosted"],"not_affected_if":["kadmind-not-running","network-restricted"],"how_to_check":"- Check the krb5 version (rpm -q krb5-server / dpkg -l krb5-admin-server); below 1.22.3 is affected, though distro builds may backport the fix.\n- Check whether kadmind is running and whether its port (749/tcp) is reachable from untrusted networks.","fix":"Upgrade MIT krb5 to 1.22.3 or later (patch release per MITKRB5-SA-2026-001); distro packages: use the vendor's backport.","status":"open","published_at":"2026-11-09T19:16:41+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","triaged_at":"2026-11-09T19:29:42+00:00","updated_at":"2026-11-09T19:36:10+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-09T19:29:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MIT Kerberos: repeated failed GSSAPI requests exhaust kadmind memory","impact":"medium","summary":"The AUTH_GSSAPI handler in MIT Kerberos 5 keeps client state for each failed AUTH_GSSAPI_INIT request for 15 minutes. A remote attacker can send many such requests to make kadmind run out of memory and stop serving.","audience":"businesses","category":"other","nicknames":[],"who_cares":["kerberos","mit-kerberos","kadmind","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker crashes kadmind through memory exhaustion","analyst_note":"Find the fixed krb5 version and the MIT advisory for CVE-2026-112323; the sources give no fixed versions or patch.","how_to_check":"- Check whether `kadmind` is running on the host and whether the krb5 version is `1.5.2` or later.\n- Confirm whether the RPC admin service (kadmind) is reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["kadmind-not-running","network-restricted"],"who_is_affected":"Systems running MIT Kerberos 5 kadmind, the Kerberos administration daemon, with its RPC service reachable over the network. Hosts that do not run kadmind or keep it off untrusted networks are less exposed. The sources do not state which versions are fixed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4653,"output_tokens":565,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed krb5 version and the MIT advisory for CVE-2026-112323; the sources give no fixed versions or patch.","search":"'-112323':12A,15A '-2026':11A,14A '1.5.2':77C '15':45B,113C '5':33B,74C 'accumul':121C 'aka':75C 'alloc':104C 'allow':80C,117C 'attack':49B,82C,119C 'auth':27B,40B,66C,97C 'caus':84C 'client':35B,105C 'cve':10A,13A 'denial':86C 'exhaust':7A,90C 'expir':115C 'fail':4A,39B,96C,102C 'faster':123C 'freed':110C 'gssapi':5A,28B,41B,67C,98C 'handler':29B,68C 'host':25B 'init':42B,99C 'kadmind':8A,17B,57B,92C 'keep':34B 'kerbero':2A,18B,21B,32B,73C 'krb5':16A,76C 'later':79C 'lib/rpc/svc_auth_gssapi.c':70C 'make':56B 'mani':52B 'memori':9A,61B,89C,122C 'minut':46B,114C 'mit':1A,20B,31B,72C 'mit-kerbero':19B 'reclaim':127C 'remot':48B,81C 'repeat':3A,95C 'request':6A,43B,54B,100C,103C 'run':58B 'self':24B 'self-host':23B 'send':51B,94C 'serv':64B 'servic':88C 'state':36B,106C 'stop':63B 'timeout':116C","nicknames":[],"mitigations":[],"who_affected":"Systems running MIT Kerberos 5 kadmind (the Kerberos admin daemon) with its RPC service reachable over the network, on krb5 versions before 1.22.3. Hosts that do not run kadmind or keep it off untrusted networks can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["krb5"],"ptokens":["krb5"],"labels":["high","kadmind","kerberos","mitkerberos","other","selfhosted"],"campaign_type":null,"search_a":"'-112323':12A,15A '-2026':11A,14A 'cve':10A,13A 'exhaust':7A 'fail':4A 'gssapi':5A 'kadmind':8A 'kerbero':2A 'krb5':16A 'memori':9A 'mit':1A 'repeat':3A 'request':6A","search_b":"'15':45B '5':33B 'attack':49B 'auth':27B,40B 'client':35B 'fail':39B 'gssapi':28B,41B 'handler':29B 'host':25B 'init':42B 'kadmind':17B,57B 'keep':34B 'kerbero':18B,21B,32B 'make':56B 'mani':52B 'memori':61B 'minut':46B 'mit':20B,31B 'mit-kerbero':19B 'remot':48B 'request':43B,54B 'run':58B 'self':24B 'self-host':23B 'send':51B 'serv':64B 'state':36B 'stop':63B","search_c":"'1.5.2':77C '15':113C '5':74C 'accumul':121C 'aka':75C 'alloc':104C 'allow':80C,117C 'attack':82C,119C 'auth':66C,97C 'caus':84C 'client':105C 'denial':86C 'exhaust':90C 'expir':115C 'fail':96C,102C 'faster':123C 'freed':110C 'gssapi':67C,98C 'handler':68C 'init':99C 'kadmind':92C 'kerbero':73C 'krb5':76C 'later':79C 'lib/rpc/svc_auth_gssapi.c':70C 'memori':89C,122C 'minut':114C 'mit':72C 'reclaim':127C 'remot':81C 'repeat':95C 'request':100C,103C 'send':94C 'servic':88C 'state':106C 'timeout':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","severity":null,"published_at":"2026-11-09T19:16:41+00:00","modified_at":"2026-11-09T19:16:41+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","fetched_at":"2026-11-09T19:28:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112323:2338","url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","severity":null,"published_at":"2026-11-09T19:36:10+00:00","modified_at":"2026-11-09T19:36:10+00:00","first_seen_at":"2026-11-09T19:36:10+00:00","fetched_at":"2026-11-09T19:36:10+00:00","note":"MIT advisory MITKRB5-SA-2026-001 (fixed in 1.22.3) lists CVE-2026-112323 among its DoS CVEs, no per-CVE detail; read via page summarizer, web search unavailable (Exa credits exhausted). Affected lower bound 1.5.2 from NVD. Not marked verified; re-read raw advisory to confirm. Sibling CVE-2026-119079 is in same advisory.","cites":["https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt"]}],"documents":[{"id":109492,"url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","title":"MITKRB5-SA-2026-001: Multiple vulnerabilities fixed in 1.22.3","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}