ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-112319

Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation

CVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 9 Nov 2026 21:02:10 UTC. Read the latest advisory.

cve-program · CVE-2026-112319

Published

The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-112319

Published

krb5

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "krb5",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

krb5

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "krb5",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:6"
                    ]
                }

krb5

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "krb5",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ]
                }

krb5

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "krb5",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

krb5

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "krb5",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

krb5

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Hardened Images",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "krb5",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:hummingbird:1"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON