ALPINE-CVE-2026-112321: High severity alpine/krb5 vulnerability

Q: What access does an attacker need to exploit this issue?

The attack is network-accessible and requires no privileges or user interaction. An attacker must be able to send crafted AUTH_GSSAPI_INIT requests that trigger authentication failures in kadmind.

Q: Which security property is affected by successful exploitation?

The reported impact is availability: repeated triggering can exhaust memory in kadmind and cause a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.

Published Nov 9, 2026

Updated

The AUTHGSSAPI handler in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTHGSSAPIINIT requests that trigger authentication failures.

Affected Software

1 affected componentFixes available

alpine/krb5<1.22.3-r0

1.22.3-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/krb5 to a version that resolves this vulnerability.
Fixed in 1.22.3-r0

Event History

Nov 9, 2026

CVE Published

via OSV·07:16 PM

Data Sourced

via OSV·07:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack is network-accessible and requires no privileges or user interaction. An attacker must be able to send crafted AUTH_GSSAPI_INIT requests that trigger authentication failures in kadmind.

Which security property is affected by successful exploitation?