Medium 5.3

The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4...

CVE-2026-112315 First seen on SecPulse Nov 10, 04:07

Fix status by distribution

Records published by each distribution for this CVE. Fixed versions differ by release; check each link.

Alpine Linux ALPINE-CVE-2026-112315 krb5 Fix available
BellSoft Alpaquita BELL-CVE-2026-112315 krb5 Fix available
Debian DEBIAN-CVE-2026-112315 krb5 No fixed version in this record
Ubuntu UBUNTU-CVE-2026-112315 krb5 No fixed version in this record

Original description The description as published by the source.

The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 04:07
GHSA: GHSA-m944-gjcr-635h
CWE: CWE-772

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

Attack Types

Denial of Service

CWE

CWE-772

Vendors

Red Hat

All

Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat Enterprise Linux 102 Extended Update Support Red Hat Enterprise Linux 98 Extended Update Support

Operating Systems

RHEL

Detection sources

NIST National Vulnerability Database09:20
GitHub Security Advisories (Global)09:31
Red Hat Security AdvisoriesNov 10, 09:20
CVE.org (CVE Program・cvelistV5)08:01