ALPINE-CVE-2026-112323: High severity alpine/krb5 vulnerability
The AUTHGSSAPI handler in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTHGSSAPIINIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/krb5to a version that resolves this vulnerability.Fixed in 1.22.3-r0
Event History
Frequently Asked Questions
Which systems are exposed to this denial-of-service condition?
Systems running kadmind with the AUTH_GSSAPI handler are exposed. The issue affects MIT Kerberos 5 version 1.5.2 and later, as described for the Alpine krb5 package.
What does an attacker need to exploit the issue?
An attacker can exploit it remotely without authentication or user interaction by repeatedly sending failed AUTH_GSSAPI_INIT requests. The requests cause client state to accumulate in kadmind until it is reclaimed after the 15-minute expiration timeout.
What is the operational impact of exploitation?
Repeated failed requests can exhaust kadmind memory faster than expired client state is freed. This can cause a denial of service; the provided impact data indicates availability impact only, with no confidentiality or integrity impact.