RLSA-2026:99715 — Important: krb5 security, bug fix, and enhancement update

Summary

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es):

* krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests (CVE-2026-112323)

* krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322)

* krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)

* krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request (CVE-2026-71200)

* krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths (CVE-2026-112321)

* krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching (CVE-2026-112320)

* krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

* krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation (CVE-2026-112319)

* krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers (CVE-2026-112318)

* krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path (CVE-2026-112317)

* krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)

* krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure (CVE-2026-112316)

* krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)

* krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure (CVE-2026-112315)

* krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)

* krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)

* krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)

* krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)

* krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

Bug Fix(es) and Enhancement(s):

* Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-9.9.z] (JIRA:Rocky Linux-278059)

* auth_gssapi_wrap_data xdr_bytes failure leak [rhel-9.9.z] (JIRA:Rocky Linux-296018)

* xdr_bytes() does not free its allocation on partial decode failure [rhel-9.9.z] (JIRA:Rocky Linux-296030)

* RPCSEC_GSS context lifecycle leaks [rhel-9.9.z] (JIRA:Rocky Linux-296039)

* xdr_krb5_principal decode leak [rhel-9.9.z] (JIRA:Rocky Linux-296051)

* process_chpw_request leak [rhel-9.9.z] (JIRA:Rocky Linux-296062)

* Read overruns in GSSRPC svcauth_unix [rhel-9.9.z] (JIRA:Rocky Linux-296073)

* Null dereference in KDC dispatch corner case [rhel-9.9.z] (JIRA:Rocky Linux-296085)

* KDC DoS based on otherName value in PKINIT SAN code [rhel-9.9.z] (JIRA:Rocky Linux-296103)

* Memory leak on krb5 gss_accept_sec_context() failure [rhel-9.9.z] (JIRA:Rocky Linux-296119)

* KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers [rhel-9.9.z] (JIRA:Rocky Linux-296134)

* Null dereference of principal names in krb5_rd_cred() [rhel-9.9.z] (JIRA:Rocky Linux-297007)

* Dereference of empty first credential list element in GSS mechanism [rhel-9.9.z] (JIRA:Rocky Linux-297015)

* Fix validation issues for trusted inputs [rhel-9.9.z] (JIRA:Rocky Linux-299746)

* Skip expired keys when iterating over KEYRING ccache [rhel-9.9.z] (JIRA:Rocky Linux-299747)

* Pass through null deleg_cred from SPNEGO to mech [rhel-9.9.z] (JIRA:Rocky Linux-299748)

* Fix leaks on error in PKINIT signed-data creation [rhel-9.9.z] (JIRA:Rocky Linux-299749)

* Fix hex key input handling in ktutil addent [rhel-9.9.z] (JIRA:Rocky Linux-299750)

* Check reply length before V4 reply check [rhel-9.9.z] (JIRA:Rocky Linux-299751)

* Fix memory leak in mpool_get() error paths [rhel-9.9.z] (JIRA:Rocky Linux-299752)

* json: Correctly abort parse on invalid array [rhel-9.9.z] (JIRA:Rocky Linux-299753)

* Prevent unsigned int overflow in iakerb_save_token() [rhel-9.9.z] (JIRA:Rocky Linux-299754)

* Fix ksu memory leak in fcmd_resolve() [rhel-9.9.z] (JIRA:Rocky Linux-299755)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 83

Release	Package	Fixed in
Rocky Linux · 9	krb5-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-debugsource	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-debugsource	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-debugsource	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-debugsource	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-debugsource	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-devel	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-devel	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-devel	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-devel	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-devel	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-libs-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-pkinit-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-server-ldap-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-workstation	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-workstation	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-workstation	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-workstation	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-workstation-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-workstation-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-workstation-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-workstation-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	krb5-xrealmauthz-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5-debuginfo	0:1.21.1-10.el9_9.2
Rocky Linux · 9	libkadm5-debuginfo	0:1.21.1-10.el9_9.2

Vulnerabilities 13

High 7.5

CVE-2026-112314

Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries

clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatche…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
High 7.5

CVE-2026-112320

Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching

The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote atta…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
High 7.5

CVE-2026-112321

Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT re…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
High 7.5

CVE-2026-112322

Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup

clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by acc…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
High 7.5

CVE-2026-112323

Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request all…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
High 7.5

CVE-2026-119079

Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding

decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthe…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
Medium 6.5

CVE-2026-107778

MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()

MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more ti…

MIT krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Oct 8, 2026
Medium 6.5

CVE-2026-112316

Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failure

xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a …

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
Medium 6.5

CVE-2026-112318

Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers

The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointe…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
Medium 6.5

CVE-2026-112319

Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation

The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that tri…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
Medium 5.3

CVE-2026-112315

Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failure

The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSE…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
Medium 5.3

CVE-2026-112317

Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path

krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 9, 2026
Medium 4.9

CVE-2026-107708

MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S…

MIT krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Oct 8, 2026

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2478440
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478445
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478446
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478447
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478448
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478449
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478672
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478684
report
https://bugzilla.redhat.com/show_bug.cgi?id=2478792
report
https://bugzilla.redhat.com/show_bug.cgi?id=2479209
report
https://bugzilla.redhat.com/show_bug.cgi?id=2479231
report
https://bugzilla.redhat.com/show_bug.cgi?id=2479331
report
https://bugzilla.redhat.com/show_bug.cgi?id=2479394
report
https://bugzilla.redhat.com/show_bug.cgi?id=2479403
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548262
report
https://bugzilla.redhat.com/show_bug.cgi?id=2548269
report
https://bugzilla.redhat.com/show_bug.cgi?id=2563453
report
https://bugzilla.redhat.com/show_bug.cgi?id=2563461
report
https://bugzilla.redhat.com/show_bug.cgi?id=2569161
advisory
https://access.redhat.com/errata/RHSA-2026:99715

Important: krb5 security, bug fix, and enhancement update

Summary

Fixed packages 83

Vulnerabilities 13

Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries

Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching

Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths

Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup

Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests

Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding

MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()

Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failure

Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers

Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation

Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failure

Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path

MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

References