Medium 6.5

The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data,...

CVE-2026-112319 First seen on SecPulse Nov 10, 04:08

Fix status by distribution

Records published by each distribution for this CVE. Fixed versions differ by release; check each link.

Alpine Linux ALPINE-CVE-2026-112319 krb5 Fix available
BellSoft Alpaquita BELL-CVE-2026-112319 krb5 Fix available
Debian DEBIAN-CVE-2026-112319 krb5 No fixed version in this record
Ubuntu UBUNTU-CVE-2026-112319 krb5 No fixed version in this record

Original description The description as published by the source.

The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.5; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 04:08
GHSA: GHSA-c6m7-hx4w-rj9w
CWE: CWE-770

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Denial of Service

CWE

CWE-770

Vendors

Red Hat

All

Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat Enterprise Linux 102 Extended Update Support Red Hat Enterprise Linux 98 Extended Update Support

Operating Systems

RHEL

Detection sources

NIST National Vulnerability Database09:20
GitHub Security Advisories (Global)09:31
Red Hat Security AdvisoriesNov 10, 09:20
CVE.org (CVE Program・cvelistV5)08:01