ALPINE-CVE-2026-112322: High severity alpine/krb5 vulnerability
cleanclient() in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTHGSSAPI client entries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/krb5to a version that resolves this vulnerability.Fixed in 1.22.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running kadmind are exposed when they can accumulate a large number of AUTH_GSSAPI client entries. The reported impact is CPU consumption in kadmind.
Does exploitation require credentials or user interaction?
No. The vector is network-based, with low attack complexity, no privileges required, and no user interaction required.
What is the expected security impact?
The issue is a denial of service through high CPU consumption. The supplied severity vector indicates availability impact only, with no confidentiality or integrity impact.