ALPINE-CVE-2026-112315: Medium severity alpine/krb5 vulnerability
The RPCSECGSS authentication routines in lib/rpc/authgssprot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSECGSS messages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/krb5to a version that resolves this vulnerability.Fixed in 1.22.3-r0
Event History
Frequently Asked Questions
Which service is affected in practice?
The described denial of service affects kadmind, the Kerberos administration daemon, when it processes crafted RPCSEC_GSS messages.
What does an attacker need to exploit this issue?
An attacker can trigger the memory leak remotely by sending crafted RPCSEC_GSS messages. No privileges or user interaction are required according to the supplied severity vector.
What is the expected impact?
Repeated exploitation can cause a denial of service through memory leakage in kadmind. The provided vector indicates availability impact only, with no stated confidentiality or integrity impact.