ALPINE-CVE-2026-112317: Medium severity alpine/krb5 vulnerability
krb5ktkdbgetentry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/krb5to a version that resolves this vulnerability.Fixed in 1.22.3-r0
Event History
Frequently Asked Questions
Which services are exposed to this issue?
The memory leak affects the KDC or kadmind when they process requests that repeatedly trigger key decryption failures. Systems not running either of these Kerberos services are not identified as affected by the available data.
What does an attacker need to do to exploit it?
An attacker needs to send requests that repeatedly cause key decryption to fail after decryption has occurred. No privileges or user interaction are required according to the supplied vector.
What is the likely impact of successful exploitation?
Repeated triggering can leak memory in the KDC or kadmind and cause a denial of service. The provided impact information identifies availability impact only, with no confidentiality or integrity impact.