PT-2026-140976
CVE-2026-112321
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The AUTH GSSAPI handler in lib/rpc/svc auth gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH GSSAPI INIT requests that trigger authentication failures.
Found an issue in the description? Have something to add? Feel free to write us 👾