ALPINE-CVE-2026-112319: Medium severity alpine/krb5 vulnerability
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/krb5to a version that resolves this vulnerability.Fixed in 1.22.3-r0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected Alpine krb5 package are exposed where kadmind is reachable by remote authenticated users. The vulnerable component is the GSS-RPC layer used by kadmind.
What does an attacker need to exploit it?
An attacker needs valid authentication and network access to send crafted RPC requests to kadmind. No user interaction is required.
What is the likely impact of exploitation?
Successful exploitation can exhaust memory or consume excessive CPU in kadmind, resulting in denial of service. The provided severity vector indicates no confidentiality or integrity impact.