ALPINE-CVE-2026-112316: Medium severity alpine/krb5 vulnerability
xdrkrb5tldata() in lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/krb5to a version that resolves this vulnerability.Fixed in 1.22.3-r0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to authenticate to kadmind and send crafted RPC requests. Unauthenticated remote users are not described as able to trigger the memory leak.
What is the operational impact?
Repeated crafted requests that cause decoding failures can leak memory in kadmind, potentially exhausting available memory and causing a denial of service. The issue affects availability; no confidentiality or integrity impact is stated.
How can I determine whether a system is exposed?
Systems running kadmind from the Alpine krb5 package are the relevant exposure point. Review whether remote authenticated users can access its RPC interface and monitor the kadmind process for unexpected memory growth or repeated decode failures.