CVE-2026-112320
Awaiting Analysis
Awaiting Analysis - Queue
GSS-RPC Memory Exhaustion in MIT Kerberos 5
Vulnerability report for CVE-2026-112320, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-09
Last updated on: 2026-11-09
Assigner: redhat-SADP
Description
Description
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | * |
| Red Hat | Red Hat Enterprise Linux 7 | * |
| Red Hat | Red Hat Enterprise Linux 8 | * |
| Red Hat | Red Hat Enterprise Linux 9 | * |
| Red Hat | Red Hat Hardened Images | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-772 | The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. |
