This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-112320 →
Unrated
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches fro...
ALPINE-CVE-2026-112320
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Alpine:v3.24krb5 |
< 1.22.3-r0→ 1.22.3-r0 |
1.22.3-r0 |
| Alpine:v3.23krb5 |
< 1.22.3-r0→ 1.22.3-r0 |
1.22.3-r0 |
Original description The description as published by the source.
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- advisory security.alpinelinux.org