PT-2026-140969

clnttcp call in lib/rpc/clnt tcp.c in MIT Kerberos 5 aka krb5 does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service memory leak in GSS-RPC client programs by injecting RPC replies with mismatched XIDs or by triggering authentication retri...