Vulnerability record/PUBLISHED/Published Nov 9, 2026 18:43:29 UTC
CVE-2026-112323
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
Base score7.5/ 10
SeverityHighCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactNoneI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 9, 2026 18:43:29 UTC
PublishedNov 9, 2026 18:43:29 UTC
ReservedOct 19, 2026 14:29:07 UTC
Credits
- This issue was discovered by Found by AISLE in partnership with Red Hat.