Medium 5.3

krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not...

CVE-2026-112317 First seen on SecPulse Nov 10, 04:07

Fix status by distribution

Records published by each distribution for this CVE. Fixed versions differ by release; check each link.

Alpine Linux ALPINE-CVE-2026-112317 krb5 Fix available
BellSoft Alpaquita BELL-CVE-2026-112317 krb5 Fix available
Debian DEBIAN-CVE-2026-112317 krb5 No fixed version in this record
Ubuntu UBUNTU-CVE-2026-112317 krb5 No fixed version in this record

Original description The description as published by the source.

krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 04:07
GHSA: GHSA-55cc-mvrc-567q
CWE: CWE-772

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

Attack Types

Denial of Service

CWE

CWE-772

Vendors

Red Hat

All

Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat Enterprise Linux 102 Extended Update Support Red Hat Enterprise Linux 98 Extended Update Support

Operating Systems

RHEL

Detection sources

NIST National Vulnerability Database09:20
GitHub Security Advisories (Global)09:32
Red Hat Security AdvisoriesNov 10, 09:20
CVE.org (CVE Program・cvelistV5)08:01