DEBIAN-CVE-2026-112314: High severity debian/krb5 vulnerability
clnttcpcall() in lib/rpc/clnttcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this denial of service?
The affected component is MIT Kerberos 5's GSS-RPC client functionality. Exposure applies to GSS-RPC client programs that use clnttcp_call(), rather than necessarily every system with krb5 installed.
What does an attacker need to do to trigger the issue?
An attacker can inject RPC replies with mismatched XIDs, or cause authentication retries. The issue is remotely reachable and requires no privileges or user interaction according to the supplied severity vector.
What is the practical impact of successful exploitation?
Repeated triggering leaks memory because the RPC reply verifier is not freed between retries. This can exhaust memory in the affected GSS-RPC client program and cause a denial of service.