CVE-2026-112321 Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths

The AUTHGSSAPI handler in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service memory exhaustion in kadmind via crafted AUTHGSSAPIINIT requests that trigger authentication failures...

CVE-2026-112323

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c within MIT Kerberos 5 (krb5) version 1.5.2 and later is vulnerable to a denial of service via memory exhaustion in kadmind . An attacker can trigger this by sending repeated failed AUTH_GSSAPI_INIT requests, which allocate client state that rem...

CVE-2026-112322 Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup

cleanclient in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service CPU consumption in kadmind by accumulating a large number of AUTHGSSAPI client...

CVE-2026-112322

cleanclient in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service CPU consumption in kadmind by accumulating a large number of AUTHGSSAPI client...

CVE-2026-112322: Red Hat: clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client…

cleanclient in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service CPU consumption in kadmind by accumulating a large number of AUTHGSSAPI client...