CVE-2026-112320

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112320", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-19T14:26:51.377Z", "datePublished": "2026-11-09T19:08:07.434Z", "dateUpdated": "2026-11-12T23:01:17.259Z"}, "containers": {"cna": {"title": "Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "versions": [{"version": "0:1.21.3-11.el10_3.2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:10.3"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.2 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "versions": [{"version": "0:1.21.3-10.el10_2.2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.2"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "versions": [{"version": "0:1.21.1-10.el9_9.2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "versions": [{"version": "0:1.21.1-10.el9_9.2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.8 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "versions": [{"version": "0:1.21.1-10.el9_8.3", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_eus:9.8::appstream", "cpe:/o:redhat:rhel_eus:9.8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "krb5", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:hummingbird:1"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:99624", "name": "RHSA-2026:99624", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:99625", "name": "RHSA-2026:99625", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:99715", "name": "RHSA-2026:99715", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:99716", "name": "RHSA-2026:99716", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-112320", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478449", "name": "RHBZ#2478449", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-11-09T15:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-772", "description": "Missing Release of Resource after Effective Lifetime", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-772: Missing Release of Resource after Effective Lifetime", "workarounds": [{"lang": "en", "value": "Restrict network access to kadmind to trusted hosts, or disable it in favor of kadmin.local server-side command line tool for administration operations if possible."}], "timeline": [{"lang": "en", "time": "2026-05-18T03:32:25.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-09T15:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by Found by AISLE in partnership with Red Hat."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-12T23:01:17.259Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T16:37:24.602764Z", "id": "CVE-2026-112320", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T18:05:17.103Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.3"], "defaultStatus": "affected", "packageName": "krb5", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.21.3-11.el10_3.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.2"], "defaultStatus": "affected", "packageName": "krb5", "product": "Red Hat Enterprise Linux 10.2 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.21.3-10.el10_2.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "krb5", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.21.1-10.el9_9.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "krb5", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.21.1-10.el9_9.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.8::appstream", "cpe:/o:redhat:rhel_eus:9.8::baseos"], "defaultStatus": "affected", "packageName": "krb5", "product": "Red Hat Enterprise Linux 9.8 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.21.1-10.el9_8.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unknown", "packageName": "krb5", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "krb5", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "krb5", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "krb5", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}], "id": "CVE-2026-112320", "lastModified": "2026-11-13T00:20:08.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112320", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T16:37:24.602764Z", "version": "2.0.3"}}]}, "published": "2026-11-09T19:16:40.887", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99624"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99625"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99715"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99716"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-112320"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478449"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-772"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "This issue was discovered by Found by AISLE in partnership with Red Hat.", "bugzilla": {"description": "krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching", "id": "2478449", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478449"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."], "mitigation": {"lang": "en:us", "value": "Restrict network access to kadmind to trusted hosts, or disable it in favor of kadmin.local server-side command line tool for administration operations if possible."}, "name": "CVE-2026-112320", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-09T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112320\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112320"], "statement": "This vulnerability is rated with an Important severity because it enables unauthenticated remote attackers to trigger unbounded heap memory exhaustion, leading to a service crash or denial of service across exposed RPC services. In Red Hat Enterprise Linux environments, exploitation requires direct network reachability to daemons utilizing the internal GSS-RPC transport over persistent TCP connections, such as the Kerberos administration server (kadmind). Because the flaw does not facilitate remote code execution or unauthorized access to sensitive Kerberos database records, it does not warrant a Critical rating.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "red_hat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Hardened Images", "source": "cna", "vendor": "Red Hat"}, "product": "hardened_images", "vendor": "redhat"}], "created": "2026-11-09T22:00:15.820076+00:00", "updated": "2026-11-10T13:15:15.274081+00:00", "vendors": ["red_hat", "red_hat$PRODUCT$enterprise_linux", "redhat", "redhat$PRODUCT$enterprise_linux", "redhat$PRODUCT$hardened_images"]}