ALPINE-CVE-2026-112320: High severity alpine/krb5 vulnerability
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSECGSS or AUTHGSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/krb5to a version that resolves this vulnerability.Fixed in 1.22.3-r0
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
No. The vulnerability is rated with no privileges required and no user interaction required, so a remote attacker can trigger it without authenticating.
Which service is affected in practice?
The denial of service occurs in kadmind when a client uses the GSS-RPC transport over a TCP connection and switches from an RPCSEC_GSS or AUTH_GSSAPI authentication flavor to a non-GSS flavor on that same connection.
What attacker behavior causes resource exhaustion?
An attacker repeatedly establishes GSS authentication contexts and abandons them after switching authentication flavors. The prior contexts are not released, allowing memory consumption in kadmind to accumulate.