KRB5 · CVE-2026-119079 · Infrastructure
FIX → 1.22.3 ✓ verified
MIT Kerberos 5 (krb5) 1.11 and later grows a decoded element array one entry at a time in decode_sequence_of(). A remote attacker can send an unauthenticated AS-REQ or TGS-REQ over TCP with a very large SEQUENCE OF field to consume CPU on the KDC and cause denial of service.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run their own MIT Kerberos KDC (krb5kdc) reachable over TCP, including Linux/Unix realms and appliances built on MIT krb5. An unauthenticated client can send an oversized AS-REQ or TGS-REQ to burn KDC CPU, which can block logins. Active Directory domain controllers and managed Kerberos services do not run this code and can skip it; so can KDCs not reachable by untrusted clients.
Not affected if active-directory-only, managed-hosting, no-kdc-running, udp-only
Who cares active-directory-adjacent, kdc, kerberos, mit-kerberos, self-hosted
krb5-config --version or your package manager (e.g. rpm -q krb5-server, dpkg -l krb5-kdc)1.22.3 that runs krb5kdc and accepts TCP (port 88) is in scope; the advisory does not give an exact lower bound (NVD summary says 1.11 and later)decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.22.3
1.22.3 (MITKRB5-SA-2026-001)