Skip to content
High-Risk CVEs in MIT Kerberos 5 Affecting Red Hat Systems

High-Risk CVEs in MIT Kerberos 5 Affecting Red Hat Systems

First seen 10 Nov 2026, 01:39 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 01:40 UTC
  • •Three high-risk CVEs in MIT Kerberos 5 disclosed on November 9, 2026.
  • •Vulnerabilities allow remote denial of service through memory exhaustion.
  • •Immediate patching and network restrictions are recommended for affected systems.

Three vulnerabilities (CVE-2026-112320, CVE-2026-112323, CVE-2026-119079) in MIT Kerberos 5 have been disclosed, allowing remote attackers to cause denial of service through memory exhaustion in the kadmind service. These vulnerabilities affect Red Hat Enterprise Linux environments, specifically targeting the GSS-RPC transport layer and the AUTH_GSSAPI handler. Attackers can exploit these flaws without requiring credentials or user interaction, making them particularly dangerous for systems exposed to untrusted networks. The vulnerabilities were published on November 9, 2026, and are rated as high severity with CVSS scores of 7.5. Organizations are advised to restrict network access to affected services and apply patches promptly. No active exploitation has been confirmed, but the potential for disruption is significant.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 4d ago How this analysis works

Timeline

2026-11-09
CVE-2026-112320 published
Vulnerability allows memory exhaustion in kadmind via GSS-RPC transport layer.
Redpacketsecurity
2026-11-09
CVE-2026-112323 published
Vulnerability allows memory exhaustion in kadmind via repeated failed AUTH_GSSAPI_INIT requests.
Redpacketsecurity
2026-11-09
CVE-2026-119079 published
Vulnerability allows CPU consumption in KDC by sending crafted AS-REQ or TGS-REQ requests.
Redpacketsecurity

More articles in this cluster (9)

Following this threat?

Track Red Hat and CVE-2026-112320 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

Which versions of MIT Kerberos are affected?
MIT Kerberos 5 versions 1.4 and later are affected by CVE-2026-112320 and CVE-2026-112323, while CVE-2026-119079 affects versions 1.11 and later.
What should organizations do to mitigate these vulnerabilities?
Organizations should apply the vendor's security updates promptly and restrict network access to the affected services.
Is there any active exploitation of these vulnerabilities?
Currently, there is no confirmed active exploitation reported for these vulnerabilities.