Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests
Affects MIT Krb5 kadmind on Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images when the service is enabled and running. No fixed version is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. kadmind service is enabled and running; it is not enabled by default on standard RHEL installations The kadmind admin RPC endpoint is reachable over the network by the attacker
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 35/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
MIT Kerberos 5 (krb5)'s kadmind administration daemon can be made to run out of memory by an attacker who connects over the network without logging in. Repeated failed AUTH_GSSAPI_INIT requests each leave client state allocated for 15 minutes, so memory builds up faster than it is freed and the service is denied.
Read the original description
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach10/20Shipped in major Linux distributions
- Severity7.5/10CVSS 7.5
- No patch5/5No patch listed yet
What would change the score
- Would score about 85 if added to CISA KEV
- Would score about 80 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
kadmind service is enabled and running; it is not enabled by default on standard RHEL installations The kadmind admin RPC endpoint is reachable over the network by the attackerWorkaround: Restrict network access to kadmind to trusted hosts, or disable kadmind in favor of the kadmin.local command line tool for administration operations if possible.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
- krb5
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-112323
Is CVE-2026-112323 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Repeated failed authentication requests to kadmind's GSSAPI initialization can cause sustained memory exhaustion, which leads to a denial of service. The flaw can be triggered over the network without credentials.Source: access.redhat.com, bugzilla.redhat.com
Am I affected, and how do I check?
The listed products are Red Hat Enterprise Linux 6, 7, 8, 9, and 10 and Red Hat Hardened Images. The kadmind service must be enabled and running, and it is not enabled by default on standard RHEL installations, so check whether that service is enabled and running on the system.Source: access.redhat.com, bugzilla.redhat.com
How do I fix CVE-2026-112323?
The checked facts list no fixed version, so no upgrade target can be given. Until one is listed, limit network access to kadmind as described in the workaround.Source: access.redhat.com, bugzilla.redhat.com
What if there's no patch?
Restrict network access to kadmind so that only trusted hosts can reach it. If possible, disable kadmind and use the kadmin.local command line tool for administration tasks.Source: access.redhat.com, bugzilla.redhat.com