ALPINE-CVE-2026-119079: High severity alpine/krb5 vulnerability
decodesequenceof() in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/krb5to a version that resolves this vulnerability.Fixed in 1.22.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Kerberos KDCs that process AS-REQ or TGS-REQ messages over TCP are exposed. The affected decoding path is reached through unauthenticated requests containing a large number of elements in a SEQUENCE OF field.
Does an attacker need valid Kerberos credentials or user interaction?
No. The issue can be triggered remotely using an unauthenticated AS-REQ or TGS-REQ, with no user interaction required.
What operational effect should administrators expect from exploitation?
Exploitation causes excessive CPU consumption in the KDC, potentially resulting in a denial of service. The provided data does not indicate confidentiality or integrity impact.