Red Hat Security Advisory: krb5 security, bug fix, and enhancement update

Fixed packages 18

Vulnerabilities 13

• High 7.5
  CVE-2026-112314

  Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries

  clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatche…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• High 7.5
  CVE-2026-112320

  Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching

  The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote atta…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• High 7.5
  CVE-2026-112321

  Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths

  The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT re…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• High 7.5
  CVE-2026-112322

  Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup

  clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by acc…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• High 7.5
  CVE-2026-112323

  Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests

  The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request all…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• High 7.5
  CVE-2026-119079

  Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding

  decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthe…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• Medium 6.5
  CVE-2026-107778

  MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()

  MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more ti…

  MIT krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine
  Oct 8, 2026
• Medium 6.5
  CVE-2026-112316

  Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failure

  xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• Medium 6.5
  CVE-2026-112318

  Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers

  The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointe…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• Medium 6.5
  CVE-2026-112319

  Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation

  The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that tri…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• Medium 5.3
  CVE-2026-112315

  Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failure

  The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSE…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• Medium 5.3
  CVE-2026-112317

  Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path

  krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 9, 2026
• Medium 4.9
  CVE-2026-107708

  MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

  MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S…

  MIT krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine
  Oct 8, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478445
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478446
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478447
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478448
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478449
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478672
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478684
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478792
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479209
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479231
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479394
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479403
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548262
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548269
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2563453
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2563461
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2569161
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99625.json
• report
  https://access.redhat.com/security/cve/CVE-2026-71199
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-71199
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-71199
• report
  https://access.redhat.com/security/cve/CVE-2026-71200
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-71200
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-71200
• report
  https://access.redhat.com/security/cve/CVE-2026-107364
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-107364
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-107364
• report
  https://access.redhat.com/security/cve/CVE-2026-107708
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-107708
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-107708
• article
  https://github.com/krb5/krb5
• article
  https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676
• article
  https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d
• article
  https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7
• article
  https://github.com/krb5/krb5/pull/1510
• article
  https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac