This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-112322 →
Unrated
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, result...
UBUNTU-CVE-2026-112322
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Ubuntu:Pro:14.04:LTSkrb5 |
All versions→ Not listed |
Not listed |
| Ubuntu:Pro:16.04:LTSkrb5 |
All versions→ Not listed |
Not listed |
| Ubuntu:Pro:18.04:LTSkrb5 |
All versions→ Not listed |
Not listed |
| Ubuntu:20.04:LTSkrb5 |
All versions→ Not listed |
Not listed |
| Ubuntu:22.04:LTSkrb5 |
All versions→ Not listed |
Not listed |
| Ubuntu:24.04:LTSkrb5 |
All versions→ Not listed |
Not listed |
| Ubuntu:26.10krb5 |
All versions→ Not listed |
Not listed |
| Ubuntu:26.04:LTSkrb5 |
All versions→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
Source: OSV.dev (Open Source Vulnerabilities) OSV