CVE-2026-112314

clnttcpcall in lib/rpc/clnttcp.c in MIT Kerberos 5 aka krb5 does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service memory leak in GSS-RPC client programs by injecting RPC replies with mismatched XIDs or by triggering authentication retries...