ALPINE-CVE-2026-112318: Null Pointer Dereference
The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/krb5to a version that resolves this vulnerability.Fixed in 1.22.3-r0
Event History
Frequently Asked Questions
Can an unauthenticated attacker trigger this issue?
No. Exploitation requires a remote authenticated user.
What component must be reachable for exploitation?
The affected path is in the kadmind policy RPC handling code. The attacker must be able to submit a policy request with an empty policy name that reaches authorization checks or logging.
What is the operational impact of successful exploitation?
A successful request can dereference a NULL pointer and crash kadmind, causing a denial of service.