Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries
Affects the krb5 package in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 and Red Hat Hardened Images, for applications that use the TCP RPC client path. No fix is recorded in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: The checked facts give no workaround. Until a fix is installed, the facts do not say how to limit exposure beyond the condition that the application uses the TCP RPC client path.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 58/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
The MIT Kerberos 5 (krb5) GSS-RPC client library can leak memory when it retries RPC calls after receiving replies with mismatched XIDs or after authentication retries. A remote attacker can exploit this without logging in by injecting such replies, causing a denial of service in client programs that use GSS-RPC.
Read the original description
clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
cve.now Index
- Exploitation15/40CISA rates a proof of concept as public
- Exposure20/25No login or user action needed, CISA rates it automatable · Unknown: Advisories don't say whether default setups are affected
- Reach10/20Shipped in major Linux distributions
- Severity7.5/10CVSS 7.5
- No patch5/5No patch listed yet
What would change the score
- Would score about 88 if added to CISA KEV
- Would score about 83 if CISA's SSVC rates exploitation active
- Would score about 63 if advisories confirm default setups are exposed
What to do
Workaround: The checked facts give no workaround. Until a fix is installed, the facts do not say how to limit exposure beyond the condition that the application uses the TCP RPC client path.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-112314
Is CVE-2026-112314 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
When the TCP RPC client in MIT krb5 retries after a transaction ID mismatch, memory is not released, so the client process's memory grows without bound. The process may be terminated, which is a denial of service.Source: bugzilla.redhat.com
Am I affected, and how do I check?
The checked facts list Red Hat Enterprise Linux 6, 7, 8, 9, and 10 and Red Hat Hardened Images. The bug applies only where the application uses the TCP RPC client path (clnttcp_call) in the krb5 package. The facts give no affected version numbers, so check the krb5 package version on the system against the vendor advisory.Source: bugzilla.redhat.com
How do I fix CVE-2026-112314?
The checked facts do not name a fixed version or an update to install. Check the Red Hat advisory for this CVE for an updated krb5 package and apply it when it is available.Source: bugzilla.redhat.com
What if there's no patch?
The checked facts give no workaround. Until a fix is installed, the facts do not say how to limit exposure beyond the condition that the application uses the TCP RPC client path.Source: bugzilla.redhat.com