Medium 6.5

xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free...

CVE-2026-112316 First seen on SecPulse Nov 10, 04:08

Fix status by distribution

Records published by each distribution for this CVE. Fixed versions differ by release; check each link.

Alpine Linux ALPINE-CVE-2026-112316 krb5 Fix available
BellSoft Alpaquita BELL-CVE-2026-112316 krb5 Fix available
Debian DEBIAN-CVE-2026-112316 krb5 No fixed version in this record
Ubuntu UBUNTU-CVE-2026-112316 krb5 No fixed version in this record

Original description The description as published by the source.

xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.5; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 04:08
GHSA: GHSA-2qxh-4mwr-mcgw
CWE: CWE-772

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

Attack Types

Denial of Service

CWE

CWE-772

Vendors

Red Hat

All

Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat Enterprise Linux 102 Extended Update Support Red Hat Enterprise Linux 98 Extended Update Support

Operating Systems

RHEL

Detection sources

NIST National Vulnerability Database09:20
GitHub Security Advisories (Global)09:31
Red Hat Security AdvisoriesNov 10, 09:20
CVE.org (CVE Program・cvelistV5)08:01