Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation
Historical advisory recorded 9 Nov 2026 21:02:10 UTC. Read the latest advisory.
cve-program · CVE-2026-112319
PublishedThe GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-112319
PublishedKrb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
- Source published
- 9 Nov 2026 19:08:05 UTC
- Source modified
- 9 Nov 2026 19:35:07 UTC
- Saved here
- 9 Nov 2026 21:02:10 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H