CVE Alert: CVE-2026-112323 – Red Hat

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.

**Risk verdict:** This is a remotely triggerable service-availability risk; KEV, SSVC, PoC and EPSS data were not supplied, so active exploitation and exploit likelihood cannot be confirmed.

**Why this matters:** Repeated unauthenticated requests can consume memory until the administrative service becomes unavailable. The likely attacker goal is disruption of Kerberos administration, potentially delaying account, key or service-principal changes; impact depends on whether administrators rely on this service for operational recovery.

**Most likely attack path:** An attacker needs network reachability to the administration service, but no credentials or user action. Low attack complexity makes exposed instances straightforward to target; scope is unchanged, so the direct impact is on the affected service rather than indicating inherent access to other systems.

**Who is most exposed:** Environments that expose the Kerberos administration endpoint beyond trusted management networks are at greatest risk. This includes internet-reachable services and broadly accessible internal management networks.

Alert on repeated failed GSSAPI initialisation attempts from one or many sources.

Correlate authentication failures with steadily rising service-process memory.

Monitor for service restarts, OOM-killer events or administration outages.

Review firewall and flow logs for unexpected access to the administration endpoint.

Mitigation and prioritisation:

Apply the vendor’s fixed package through normal change control; expedite where the service is reachable from untrusted networks.

Restrict network access to trusted administration hosts; disable the service if operationally feasible.

Validate package status across installed systems and images, including systems with uncertain support status.

Confirm memory and service health after remediation; preserve logs for incident review.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.